Keycloak Cross-site Scripting on OpenID connect login service

A reflected cross-site scripting (XSS) vulnerability was found in the `oob` OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.

Vulnerability ID: GHSA-9hhc-pj4w-w5rv
Aliases: CVE-2022-4137
Published: 2023-03-01 17:38:56
CWE: CWE-116
CWE-79
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven
name: org.keycloak:keycloak-parent