Open Redirect

2023-03-0803:54:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

keycloak-connect

open redirect

vulnerability

check-sso.js

malicious urls

query parameters

EPSS

0.001

Percentile

31.3%

JSON

keycloak-connect is vulnerable to Open Redirect. The vulnerability exists in the module.exports function of the check-sso.js as it does not properly escape the slashes in the cleanUrl attribute, allowing an attacker to redirect the user to malicious urls with query param prompt=none when checking SSO.