CVE-2022-1274

MEDIUM5.4EPSS 0.99%

HTML Injection in Keycloak Admin REST API

Published: 3/1/2023Modified: 3/13/2026

Description

The `execute-actions-email` endpoint of the Keycloak Admin REST API allows a malicious actor to send emails containing phishing links to Keycloak users.

Affected packages (1)

Maven/org.keycloak:keycloak-servicesfrom 0, < 20.0.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-1274
PATCHhttps://github.com/keycloak/keycloak
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2073157
WEBhttps://github.com/keycloak/keycloak/commit/fc3c61235fa30132123c17ed8702ff7b3a672fe9
WEBhttps://github.com/keycloak/keycloak/pull/16764
WEBhttps://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
WEBhttps://herolab.usd.de/security-advisories/usd-2021-0033