Advisory Weakness Curation

HTML Injection in Keycloak Admin REST API The `execute-actions-email` endpoint of the Keycloak Admin REST API allows a malicious actor to send emails containing phishing links to Keycloak users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

HTML Injection in Keycloak Admin REST API The `execute-actions-email` endpoint of the Keycloak Admin REST API allows a malicious actor to send emails containing phishing links to Keycloak users.