CVE-2023-6717

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2023
Source publication: Apr 25, 2024
Source updated: Sep 11, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Keycloak: xss via assertion consumer service url in saml post-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

keycloak

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://github.com/keycloak/keycloak

keycloak · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	maven	22.0.10	Unavailable	None listed
24.0.0	`affected`	maven	24.0.3	Unavailable	None listed

Red Hat AMQ Broker 7

Vendor: Red Hat
Product: Red Hat AMQ Broker 7
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22.0.10-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22-13	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22-16	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 22.0.10

Vendor: Red Hat
Product: Red Hat build of Keycloak 22.0.10
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-data-index-ephemeral-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-data-index-postgresql-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-jobs-service-ephemeral-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-jobs-service-postgresql-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-rhel8-operator
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-3	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-swf-builder-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHOSS-1.33-RHEL-8

Vendor: Red Hat
Product: RHOSS-1.33-RHEL-8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/logic-swf-devmode-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHOSS-1.33-RHEL-8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.33.0-5	`unaffected`	rpm	*	Unavailable	None listed

RHPAM 7.13.5 async

Vendor: Red Hat
Product: RHPAM 7.13.5 async
Platforms: Unknown
Default status: unaffected
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Migration Toolkit for Applications 6

Vendor: Red Hat
Product: Migration Toolkit for Applications 6
Platforms: Unknown
Default status: affected
Package: mta/mta-ui-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Migration Toolkit for Applications 7

Vendor: Red Hat
Product: Migration Toolkit for Applications 7
Platforms: Unknown
Default status: unaffected
Package: mta/mta-ui-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Apicurio Registry 2

Vendor: Red Hat
Product: Red Hat build of Apicurio Registry 2
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus

Vendor: Red Hat
Product: Red Hat build of Quarkus
Platforms: Unknown
Default status: unaffected
Package: keycloak-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus

Vendor: Red Hat
Product: Red Hat build of Quarkus
Platforms: Unknown
Default status: unaffected
Package: keycloak-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Data Grid 8

Vendor: Red Hat
Product: Red Hat Data Grid 8
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Decision Manager 7

Vendor: Red Hat
Product: Red Hat Decision Manager 7
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Developer Hub

Vendor: Red Hat
Product: Red Hat Developer Hub
Platforms: Unknown
Default status: unaffected
Package: rhdh/rhdh-hub-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Fuse 7

Vendor: Red Hat
Product: Red Hat Fuse 7
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Data Grid 7

Vendor: Red Hat
Product: Red Hat JBoss Data Grid 7
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 6

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 6
Platforms: Unknown
Default status: unknown
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 6

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 6
Platforms: Unknown
Default status: unknown
Package: org.keycloak-keycloak-parent
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 6

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 6
Platforms: Unknown
Default status: unknown
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform Expansion Pack

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform Expansion Pack
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift GitOps

Vendor: Red Hat
Product: Red Hat OpenShift GitOps
Platforms: Unknown
Default status: affected
Package: openshift-gitops-1/gitops-rhel8-operator
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Process Automation 7

Vendor: Red Hat
Product: Red Hat Process Automation 7
Platforms: Unknown
Default status: affected
Package: keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.