Stored XSS Vulnerability in Keycloak Admin Console by Red Hat

CVE-2020-1697

What is CVE-2020-1697?

A vulnerability exists in Keycloak versions prior to 9.0.0 related to improper validation of links to external applications within the admin console. This flaw can lead to stored XSS attacks, where an authenticated malicious user could craft misleading URLs that exploit victims in different realms. Successful exploitation could allow attackers to execute arbitrary scripts in the context of the user’s session, potentially compromising sensitive information and enabling further attacks.

References