CVE-2024-4028 Keycloak-core: stored xss in keycloak when creating a items in admin console
A privileged attacker can inject malicious scripts via admin console items, leading to stored XSS and potential session hijacking.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-4028?
CVE-2024-4028 is a low-severity cross-site scripting vulnerability in Red Hat Build of Keycloak, published on 18 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.
Weakness: CWE-20
Which versions are affected by CVE-2024-4028?
2 open source packages ship an affected version, including org.keycloak:keycloak-core.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-core Maven | All versions to 26.1.2 | None |
org.keycloak:keycloak-core Maven | All versions to 26.1.2 | None |
How do I fix CVE-2024-4028?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-4028 being exploited?
There is no known exploitation of CVE-2024-4028 in the wild and no public exploit code.
Sources
Also known as ECHO-c42f-8476-7532, GHSA-q4xq-445g-g6ch.