CVE-2024-21637

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with "responsemode=formpost". This relatively user could use the described attacks to perform a privilege escalation. This...

CVE-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...

CVE-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...

CVE-2018-14655

CVE-2018-14655 affects Keycloak 3.4.3.Final, 4.0.0.Beta2 and 4.3.0.Final. When using response_mode=form_post the state parameter can be injected with arbitrary JavaScript, enabling an XSS during login. Connected sources (GHSA/RHSA/NVD) corroborate the vulnerability and link to Red Hat advisories ...

CVE-2018-14655: Improper Neutralization of Input During Web Page Generation

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...