CVE-2022-1274: HTML Injection in Keycloak Admin REST API
Summary
CVE-2022-1274: HTML Injection in Keycloak Admin REST API. Affects org.keycloak:keycloak-services versions < 20.0.5. Fixed in 20.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Keycloak Admin REST API is a component of the Keycloak identity and access management solution. It provides a programmatic interface for managing Keycloak users, roles, and other administrative tasks. Keycloak is widely used in various applications and systems to handle authentication and authorization.
The execute-actions-email endpoint of the Keycloak Admin REST API is responsible for sending emails to Keycloak users. This endpoint is vulnerable to HTML injection, which allows a malicious actor to include arbitrary HTML code in the email content. This can lead to various attacks, such as phishing, where the attacker can craft emails containing malicious links or forms that appear legitimate to the recipients.
Vulnerability Detail
The HTML injection vulnerability in the Keycloak Admin REST API can be exploited by an attacker to send phishing emails to Keycloak users. By injecting malicious HTML code into the email content, the attacker can create convincing phishing emails that trick users into clicking on malicious links or submitting sensitive information.
The impact of this vulnerability depends on the actions taken by the users who receive the phishing emails. If users fall for the phishing attack and interact with the malicious content, they may compromise their credentials or expose sensitive information. This can lead to unauthorized access to Keycloak-protected resources or other security breaches.
The vulnerability is assigned a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, organizations can disable the use of the execute-actions-email endpoint in the Keycloak Admin REST API. By preventing the execution of this endpoint, the risk of HTML injection attacks through the API can be mitigated. However, this workaround may impact the functionality of email-related features in Keycloak, so it should be considered as a temporary solution until the upgrade to a fixed version can be performed.
Conclusion
The HTML injection vulnerability in the Keycloak Admin REST API allows attackers to send phishing emails to Keycloak users, potentially leading to credential compromise or exposure of sensitive information. To mitigate this vulnerability, it is recommended to upgrade Keycloak to version 20.0.5 or later. Organizations can also temporarily disable the execute-actions-email endpoint as a workaround. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The vulnerability allows attackers to send phishing emails to Keycloak users, potentially leading to credential compromise or exposure of sensitive information.
To fix the vulnerability, upgrade Keycloak to version 20.0.5 or later, which includes a fix for the HTML injection issue.
As a temporary workaround, organizations can disable the execute-actions-email endpoint in the Keycloak Admin REST API.
There are no known public exploits for this vulnerability at the moment.
For more information, you can refer to the CVE-2022-1274 advisory or contact the Keycloak support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
