-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs because the state parameter is injected into the form_post response without proper sanitization. Keycloak's form_post implementation uses FormPostGrantHandler to generate the HTML form, and the associated FreeMarker template (form_post.ftl) would directly embed the state parameter value. If these components fail to apply HTML entity encoding to the state parameter, XSS is possible. The correlation between the attack vector (state parameter in form_post mode) and the lack of escaping in template rendering aligns with the described vulnerability mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | <= 3.4.3.Final | |
| org.keycloak:keycloak-parent | maven | >= 4.0.0.Beta1, <= 4.0.0.Beta2 | |
| org.keycloak:keycloak-parent | maven | = 4.3.0.Final |
A Semantic Attack on Google Gemini - Read the Latest Research