CVE-2020-1697: XSS in Keycloak
Summary
CVE-2020-1697: XSS in Keycloak. Affects org.keycloak:keycloak-core versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. The keycloak-core package is a core component of Keycloak that handles authentication and authorization. This package is vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in all versions of Keycloak prior to 9.0.0. It stems from a lack of proper validation of links to external applications (Application Links) in the admin console. This allows an authenticated malicious user to create URLs that can trick users in other realms, potentially leading to stored XSS attacks. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of other users, leading to unauthorized actions or data theft.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the affected functionality by removing the ability for users to create links to external applications in the admin console. This can be done by modifying the Keycloak configuration or customizing the admin console interface to remove the relevant options.
Conclusion
In conclusion, the keycloak-core package in Keycloak versions prior to 9.0.0 is vulnerable to a stored XSS attack. Upgrading to version 9.0.0 or later is recommended to fix this vulnerability. As a temporary workaround, you can disable the affected functionality by removing the ability for users to create links to external applications in the admin console. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, social login, and user federation.
Stored XSS is a type of cross-site scripting attack where malicious code is injected into a website or application and permanently stored on the server. When other users access the affected page, the malicious code is executed in their browsers, allowing the attacker to steal sensitive information or perform unauthorized actions.
An attacker with authenticated access to Keycloak can create URLs that trick users in other realms. When these URLs are accessed by the targeted users, the attacker's injected JavaScript code is executed in their browsers, potentially leading to unauthorized actions or data theft.
Yes, the vulnerability can be fixed by upgrading to Keycloak version 9.0.0 or later. This version includes the necessary validation improvements to prevent the stored XSS attack.
Yes, as a temporary workaround, you can remove the ability for users to create links to external applications in the admin console. This can be done by modifying the Keycloak configuration or customizing the admin console interface.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
