CVE-2020-10776: Cross-site Scripting in keycloak
Summary
CVE-2020-10776: Cross-site Scripting in keycloak. Affects org.keycloak:keycloak-server-spi-private versions < 12.0.0. Fixed in 12.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. Keycloak is widely used in various industries to manage user authentication and authorization. However, a vulnerability has been discovered in Keycloak that allows an attacker to perform a Cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10776, exists in Keycloak versions prior to 12.0.0. It is caused by the ability to add unsafe schemes for the redirect_uri parameter. An attacker can exploit this flaw by injecting malicious scripts into the redirect_uri, which will be executed when the user is redirected to the specified URL. This can lead to various consequences, including the theft of sensitive information, session hijacking, and unauthorized access to user accounts.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Keycloak is not immediately feasible, a temporary workaround is to manually validate and sanitize the redirect_uri parameter before using it. This can be done by implementing input validation and output encoding techniques to prevent the execution of malicious scripts. Here is an example of how to sanitize the redirect_uri parameter in Java:
String sanitizedRedirectUri = ESAPI.encoder().encodeForHTML(redirectUri);
Conclusion
In conclusion, CVE-2020-10776 is a Cross-site scripting (XSS) vulnerability in Keycloak that allows an attacker to inject malicious scripts through the redirect_uri parameter. To mitigate this vulnerability, it is crucial to upgrade Keycloak to version 12.0.0 or later. If immediate upgrade is not possible, implementing input validation and output encoding techniques can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-server-spi-private →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, social login, and user federation.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various consequences, including the theft of sensitive information and unauthorized access to user accounts.
This vulnerability allows an attacker to perform a Cross-site scripting (XSS) attack, which can lead to the theft of sensitive information, session hijacking, and unauthorized access to user accounts.
To fix this vulnerability, it is recommended to upgrade Keycloak to version 12.0.0 or later. This version includes a fix for the unsafe redirect_uri parameter.
If upgrading Keycloak is not immediately feasible, a temporary workaround is to manually validate and sanitize the redirect_uri parameter before using it.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-server-spi-private.
