cve.bz

CVE-2022-1274

5.4 mediumEPSS 0.7%

Medium (5.4) in redhat. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-services 20.0.5.

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Severity

CVSS 3.1

5.4 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-80
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m4fv-gm5m-4725Mavenorg.keycloak:keycloak-services<20.0.520.0.5

References

Check your stackJSON