CVE-2025-10044: Keycloak error_description injection on error pages that can trigger phishing attacks

The vulnerability is a phishing vector caused by the injection of arbitrary text into the error_description query parameter, which is then rendered on Keycloak's error pages. The analysis of the provided patch identified the complete flow of this vulnerability, from the backend processing to the frontend rendering.

The root cause lies in the frontend KeycloakProvider component, which reads the error_description parameter directly from the URL. This untrusted input is then passed to the ErrorPage component. The ErrorPage component, in its vulnerable state, would render any string passed to it, facilitated by the getErrorMessage helper function that processed raw strings.

On the backend, the org.keycloak.services.resources.account.AccountConsole.redirectToLogin method contributed to the issue. During the login and error handling process, this method would construct redirect URLs that preserved the error_description parameter, effectively passing the attacker-controlled input back to the frontend.

The patch addresses this vulnerability at multiple levels. It removes the backend logic for initiating the login from AccountConsole.java, including the redirectToLogin method. On the frontend, it removes the code that reads the error_description from the URL in KeycloakProvider. Furthermore, it hardens the ErrorPage and getErrorMessage functions to no longer display arbitrary strings, instead relying on a predefined set of translatable error keys. This ensures that only legitimate, translated error messages can be displayed, completely mitigating the phishing vector.