It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
{ "github_reviewed_at": "2023-07-26T19:14:49Z", "severity": "MODERATE", "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "nvd_published_at": "2017-10-26T17:29:00Z" }