What’s Vulnerable › Vulnerabilities

CVE-2022-1274

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-29 · updated 2026-06-17
• Weakness: CWE-80

Description

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Affected products

• Keycloak: before 20.0.5 — fixed in 20.0.5
• Red Hat OpenShift Container Platform 4.18: 4.9, 4.10
• Red Hat Single Sign-On: from 7.6 before 7.6.2 — fixed in 7.6.2

How to fix

Upgrade to a fixed version: Keycloak 20.0.5; Red Hat Single Sign-On 7.6.2. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2073157
• https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
• https://herolab.usd.de/security-advisories/usd-2021-0033/
• https://bugzilla.redhat.com/show_bug.cgi?id=2073157
• https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725
• https://herolab.usd.de/security-advisories/usd-2021-0033/

Get alerted when CVE-2022-1274 or the next vulnerability affects your stack