Total vulnerabilities in the database
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
| Software | From | Fixed in |
|---|---|---|
| redhat / single_sign_on | 7.0 | 7.0.x |
| redhat / single_sign_on | 7.1 | 7.1.x |