Keycloak vulnerable to path traversal via double URL encoding 

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.

Vulnerability ID: GHSA-g8q8-fggx-9r3q
Aliases: CVE-2022-3782
Published: 2022-12-13 19:44:56
CWE: CWE-177
CWE-22
Severity rating: CRITICAL
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven
name: org.keycloak:keycloak-parent