vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-4137

Keycloak: reflected xss attack

MEDIUM
6.1
CVSS Score
Published: September 25, 2023 at 07:17 PM UTC
Updated: June 17, 2026 at 05:20 AM UTC
3 products affected across 2 vendorsSingle Sign onKeycloakEnterprise Linux

Using Red Hat Single Sign-On 7 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Single Sign-On 7 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.1
Exploit prediction
EPSS 1%

Description

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Keycloak· Keycloak
95%
All versions
Single Sign on· Red Hatrpm
95%
7.6
Vendor states this is fixed in 0:18.0.6-1.redhat_00001.1.el7sso (unaffected)
Vendor states this is fixed in 0:18.0.6-1.redhat_00001.1.el8sso (unaffected)
Vendor states this is fixed in 0:18.0.6-1.redhat_00001.1.el9sso (unaffected)
Vendor states this is fixed in 7.6 (unaffected)
redhat-enterprise-linux (environment)
Enterprise Linux· Red Hatrpmdevice
80%
All versions

References (6)

Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:1043
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:1044
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:1045
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:1049
VDB Entryx_refsource_REDHATVendor Advisory
Source: [email protected]
https://access.redhat.com/security/cve/CVE-2022-4137
Issue Trackingx_refsource_REDHATVendor Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=2148496

CVSS

6.1MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-81CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card