CVE-2025-10044: Keycloak XSS Vulnerability

CVE-2025-10044 Overview

CVE-2025-10044 is a content injection flaw in Keycloak that enables user interface confusion and phishing attacks. The Keycloak account console and other error-rendering pages accept arbitrary text supplied through the error_description query parameter. This text is rendered directly on error pages without validation or sanitization.

HTML encoding blocks Cross-Site Scripting (XSS) [CWE-79], but attackers can still inject misleading strings such as fake support phone numbers or URLs. The injected content appears within the trusted Keycloak user interface, giving it the appearance of legitimate vendor communication.

Critical Impact
Attackers can craft Keycloak URLs that display attacker-controlled messages inside the authentic account console, tricking users into contacting malicious call centers or visiting fraudulent support sites.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE Details for CVE-2025-10044)
Red Hat Single Sign-On distributions covered by RHSA-2025:16399 and RHSA-2025:16400
Additional Red Hat Keycloak channels addressed in RHSA-2025:19923 and RHSA-2025:19925

Discovery Timeline

2025-09-05 - CVE-2025-10044 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10044

Vulnerability Analysis

Keycloak reflects the error_description OAuth 2.0 query parameter into rendered error pages served by the account console and related flows. The application encodes the value to prevent script execution, so XSS payloads do not fire. However, no additional validation restricts the semantic content of the string.

The result is a user interface confusion vulnerability. Any URL that reaches an error path, including malformed OAuth 2.0 authorization or logout requests, can carry attacker text. That text is displayed inside the trusted branding of the identity provider, elevating its perceived legitimacy.

The issue is tracked under CWE-79 because it stems from the same class of unsanitized reflection, even though the phishing impact rather than script execution drives the risk. The remediation is discussed in Keycloak Pull Request #42443.

Root Cause

The Keycloak error rendering logic treats the error_description parameter as a trusted display string. Developers relied on HTML encoding alone as the security control. No allowlist, length limit, or format validation is applied before the string is placed into the page template.

Attack Vector

An attacker crafts a Keycloak URL that intentionally triggers an error condition and appends a malicious error_description value. The victim clicks the link, often delivered via email or messaging, and lands on an authentic Keycloak error page. The page displays the attacker's fake support instructions, phone number, or fraudulent URL alongside legitimate branding, prompting the victim to act on the guidance.

The vulnerability is described in prose because no verified proof-of-concept code is published. See Red Hat Bug Report #2393551 for additional technical detail on the injection path.

Detection Methods for CVE-2025-10044

Indicators of Compromise

Keycloak access logs containing requests with long, human-readable strings in the error_description query parameter
URLs referencing legitimate Keycloak endpoints such as /realms/<realm>/account or /realms/<realm>/protocol/openid-connect/auth combined with unusual error and error_description values
Inbound emails or chat messages that link to your Keycloak hostname but include phone numbers or callback URLs inside the query string

Detection Strategies

Parse Keycloak and reverse proxy logs for the error_description parameter and alert on values containing phone number patterns, external URLs, or terms such as "support", "call", or "verify"
Correlate authentication error spikes with unusual referrers or campaigns of identical query strings arriving from many source addresses
Baseline the typical length and character set of error_description values produced by your own applications, then flag deviations

Monitoring Recommendations

Forward Keycloak, load balancer, and web application firewall logs to a centralized analytics platform for query string inspection
Monitor user help desk tickets for reports of unexpected support numbers displayed on the login or account portal
Track outbound DNS and proxy traffic to newly registered domains referenced from any observed error_description payloads

How to Mitigate CVE-2025-10044

Immediate Actions Required

Apply the Keycloak updates delivered in RHSA-2025:16399, RHSA-2025:16400, RHSA-2025:19923, and RHSA-2025:19925 as appropriate for your distribution
Audit recent Keycloak access logs for suspicious error_description values and notify potentially affected users
Warn help desk staff that phishing lures may impersonate the Keycloak error page and instruct users to verify support contacts through internal channels only

Patch Information

The upstream fix is implemented in Keycloak Pull Request #42443, which validates or removes attacker-controlled content from error_description before rendering. Red Hat customers should install the Keycloak or Red Hat build of Keycloak packages referenced in the security advisories above. Confirm patched versions using the version metadata provided in the Red Hat CVE Details for CVE-2025-10044.

Workarounds

Configure a reverse proxy or web application firewall rule to strip or sanitize the error_description query parameter on requests to Keycloak endpoints until patches are deployed
Override the Keycloak error template in your theme to suppress rendering of the error_description value and display only a static message
Restrict Keycloak error pages to same-site referrers where feasible, reducing exposure to externally crafted links

bash

# Example WAF/ModSecurity rule to block error_description injection attempts
SecRule ARGS:error_description "@rx (https?://|\+?\d{7,}|call|support|verify)" \
    "id:1010044,phase:2,deny,status:400,log,\
    msg:'CVE-2025-10044 Keycloak error_description injection attempt'"