PT-2018-12646

Name of the Vulnerable Software and Affected Versions Keycloak versions 3.4.3.Final through 4.3.0.Final Description A flaw in Keycloak allows the injection of arbitrary Javascript code via the state-parameter in the authentication URL when using response mode=form post. This enables a cross-site...