NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

Keycloak vulnerable to cross-site scripting via the state parameterGHSA-458h-wv48-fq75

MEDIUM

GHSA-458h-wv48-fq75 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in org.keycloak:keycloak-parent. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Also known asCVE-2018-14655
Published
Updated
Affected
3 pkgs
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs68th percentile — riskier than 68% of all scored CVEsHighest risk
0.00%0.56%1.13%1.69%0.2%1.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

3 pkgs affected
☕org.keycloak:keycloak-parent☕org.keycloak:keycloak-parent☕org.keycloak:keycloak-parent

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using response_mode=form_post it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

Affected Packages

3 total
EcosystemPackageVulnerable rangeFix
☕Mavenorg.keycloak:keycloak-parentall versionsNo fix
☕Mavenorg.keycloak:keycloak-parent≥ 4.0.0.Beta1No fix
☕Mavenorg.keycloak:keycloak-parentall versionsNo fix

Affected Products

2 products · 6 configurations
Application
keycloakredhat
3 versions
3.4.34.0.04.3.0
Application
single sign-onredhat
1 version
7.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-parent, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of org.keycloak:keycloak-parent for GHSA-458h-wv48-fq75. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate
ProductFixed inAdvisory
Red Hat Single Sign-On 7.2.5 zipsee advisoryRHSA-2018:3595
Red Hat Single Sign-On 7.2 for RHEL 6rh-sso7-keycloak-0:3.4.14-1.Final_redhat_00001.1.jbcs.el6RHSA-2018:3592
Red Hat Single Sign-On 7.2 for RHEL 7rh-sso7-keycloak-0:3.4.14-1.Final_redhat_00001.1.jbcs.el7RHSA-2018:3593

Frequently Asked Questions

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
O3 Security · Impact-Aware SCA

Is GHSA-458h-wv48-fq75 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Keycloak vulnerable to cross-site scripting via the state…