CVE-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...

CVE-2018-14655

CVE-2018-14655 affects Keycloak 3.4.3.Final, 4.0.0.Beta2 and 4.3.0.Final. When using response_mode=form_post the state parameter can be injected with arbitrary JavaScript, enabling an XSS during login. Connected sources (GHSA/RHSA/NVD) corroborate the vulnerability and link to Red Hat advisories ...