GHSA-m98g-63qj-fp8j: 
Java vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was identified in Keycloak, tracked as GHSA-m98g-63qj-fp8j and CVE-2021-20323. The vulnerability affects Keycloak versions from 10.0.0 to versions prior to 18.0.0. This security issue was discovered by Quentin TEXIER, a Pentester at Opencyber, and was publicly disclosed on April 25, 2022 (GitHub Advisory).

The vulnerability is a POST-based reflected Cross-Site Scripting (XSS) issue that exists in the client registration endpoint of Keycloak. The core of the problem lies in improper error message escaping when processing malicious requests sent to the client registration endpoint. The vulnerability has been assigned a Moderate severity rating and is associated with CWE-79 (Cross-site Scripting) (GitHub Advisory).

When exploited, this vulnerability allows attackers to execute malicious scripts in users' browsers through the client registration endpoint. The improper error message handling could lead to the execution of unauthorized JavaScript code in the context of the user's browser session (GitHub Advisory).

The vulnerability has been patched in Keycloak version 18.0.0. Users are advised to upgrade to this version or later to mitigate the risk. No alternative workarounds have been publicly documented (GitHub Advisory).