-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization of group names displayed in the admin console's groups dropdown. Since the attack requires a privileged user to create a malicious group name, the rendering logic for group names in the UI layer is the likely culprit. The absence of output encoding when injecting group names into the HTML context (e.g., via JSF components or direct HTML rendering) allows XSS. The core issue aligns with CWE-80, confirming the lack of neutralization for script-related HTML tags.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-core | maven | < 20.0.0 | 20.0.0 |
A Semantic Attack on Google Gemini - Read the Latest Research