CVE-2018-14655

—

CVSS 3.0

5.4 medium

EPSS

1%p66

Published

Nov 13, 2018 (Nov 13, 2018)

Modified

Jun 17, 2026

Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Vendors: redhat
Products: keycloak, single sign-on
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.