CVE-2022-1274: Red Hat Keycloak

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Affected products

• Red Hat Keycloak: before 20.0.5 (fixed in 20.0.5)
• Red Hat Openshift Container Platform: version 4.9 only; version 4.10 only
• Red Hat Single Sign-On: affected versions not specified; from 7.6, before 7.6.2 (fixed in 7.6.2)

Published 2023-03-29. Last modified 2026-06-17.