CVE-2021-20323: Cross-site Scripting in Keycloak
Summary
CVE-2021-20323: Cross-site Scripting in Keycloak. Affects org.keycloak:keycloak-core versions >= 15.0.0, < 17.0.0. Fixed in 17.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and social login capabilities. The 'org.keycloak:keycloak-core' package is a core component of Keycloak that handles authentication and authorization. This package is vulnerable to a reflected Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability allows an attacker to inject malicious scripts into a Keycloak instance via a POST request. This can lead to the execution of arbitrary code in the context of the victim's browser, potentially compromising sensitive user information or performing unauthorized actions. The vulnerability was identified in Keycloak version 15 and was fixed in version 17.0.0.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
17.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Keycloak is not immediately feasible, a temporary workaround is to implement input validation and output encoding to prevent the execution of malicious scripts. This can be done by sanitizing user input and encoding output to HTML entities. Here is an example of input validation in Java:
String sanitizedInput = StringEscapeUtils.escapeHtml4(userInput);
Conclusion
The Cross-Site Scripting vulnerability in Keycloak version 15 can be mitigated by upgrading to version 17.0.0 or later. Implementing input validation and output encoding can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and social login capabilities.
A reflected XSS attack occurs when an attacker injects malicious scripts into a website or application, which are then executed in the victim's browser. This can lead to the theft of sensitive information or the execution of unauthorized actions.
To fix the vulnerability, it is recommended to upgrade Keycloak to version 17.0.0 or later. Ensure that all dependencies and plugins are compatible with the new version.
If upgrading Keycloak is not immediately feasible, you can implement input validation and output encoding to prevent the execution of malicious scripts. Sanitize user input and encode output to HTML entities.
You can find more information about the vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-xpgc-j48j-jwv9/GHSA-xpgc-j48j-jwv9.json
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
