PT-2017-12373 · Red Hat · Keycloak

Published 2017-10-26 · Updated 2026-05-18 · CVE-2017-12158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where it accepts a HOST header URL in the admin console to determine web resource locations. This could be exploited by an attacker against an authenticated user to achieve reflected XSS via a malicious server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

XSS

Weakness Enumeration

CWE-444

CWE-79

Related Identifiers

CLEANSTART-2026-FA60324

CLEANSTART-2026-GX01236

CLEANSTART-2026-KC06018

CLEANSTART-2026-PO27799

CLEANSTART-2026-SG80587

CVE-2017-12158

GHSA-V38P-MQQ3-M6V5

RHSA-2017:2904

RHSA-2017:2905

Affected Products

Keycloak

References · 86

• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2905 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-KC06018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5598 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42580 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12158 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42581 · Security Note