CVE-2024-4028: Keycloak allows cross-site scripting (XSS)

February 18, 2025 (updated February 20, 2025)

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.

References

access.redhat.com/security/cve/CVE-2024-4028
bugzilla.redhat.com/show_bug.cgi?id=2276418
github.com/advisories/GHSA-q4xq-445g-g6ch
github.com/keycloak/keycloak
nvd.nist.gov/vuln/detail/CVE-2024-4028

Code Behaviors & Features

Detect and mitigate CVE-2024-4028 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →