CVE-2017-12158 | BDVDB-2026-92253 Detail

Description#

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-10-26Record published in the CVE List.
2. Version 22024-09-16Most recent update recorded in the CVE List.