Keycloak Error Description Injection Vulnerability in the Account Console

A vulnerability exists in Keycloak's account console and other pages, where the error_description query parameter can be injected with arbitrary text. This text is rendered on error pages without any validation or sanitization. Although HTML encoding mitigates cross-site scripting (XSS) risks, this flaw allows attackers to create URLs with deceptive messages, such as fake support phone numbers or URLs. These messages are displayed within the trusted Keycloak user interface, potentially leading to phishing attacks by tricking users into contacting malicious parties.

Impact

Exploitation of this vulnerability creates a phishing opportunity, as misleading messages can be injected into the Keycloak user interface, potentially deceiving users into contacting malicious actors.