GHSA-q2gp-gph3-88x9 — Vulnetix

GHSA-q2gp-gph3-88x9 REJECTED

Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled

Affected Products

Vendor	Product	Versions
Maven	org.keycloak:keycloak-saml-core	0, 1.1.0.Beta1, 1.1.0.Beta2

Timeline

Dec 5, 2024 CVE Rejected
Dec 5, 2024 CVE Updated
Mar 2, 2026 Security Advisory

References

https://nvd.nist.gov/vuln/detail/CVE-2022-2668 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2115392 url
https://github.com/keycloak/keycloak product
GitHub Advisory GHSA-q2gp-gph3-88x9 vendor-advisory
https://access.redhat.com/security/cve/CVE-2022-2668 url

Open in Interactive Console →

$ Console Community · 100/wk Open console ›