Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Red Hat build of Keycloak 跨站脚本漏洞

Red Hat build of Keycloak是美国红帽（Red Hat）公司的一款用于单点登录的Web应用。 Red Hat build of Keycloak存在跨站脚本漏洞，该漏洞源于组织选择登录页面将organization.alias置于内联JavaScript onclick处理程序中，可能导致存储型跨站脚本攻击，进而执行任意JavaScript代码。

N/A

N/A