CVE-2024-53843

@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a malicious URL to execute arbitrary JavaScript in the browser of a victim who visits the link. Any application utilizing this authentication library is vulnerable. Users of the application are at risk if they can be lured into clicking on a crafted malicious link. The vulnerability has been patched in version 2.5.5 by ensuring proper sanitization and escaping of user input in the affected URL parameters. Users are strongly encouraged to upgrade. If upgrading is not immediately possible, users can implement the following workarounds: 1. Employ a Web Application Firewall (WAF) to block malicious requests containing suspicious URL parameters. or 2. Apply input validation and escaping directly within the application’s middleware or reverse proxy layer, specifically targeting the affected parameters.

• CWE-79

• https://github.com/DapperDuckling/keycloak-connector/security/advisories/GHSA-w5rq-g9r6-vrcg

Published

Nov 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53838In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVi…7.8
• CVE-2024-53839In GetCellInfoList() of protocolnetadapter.cpp, there is a p…5.5
• CVE-2024-5384A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2024-53840there is a possible biometric bypass due to an unusual root …7.8
• CVE-2024-53841In startListeningForDeviceStateChanges, there is a possible …7.8
• CVE-2024-53842In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is …9.8
• CVE-2024-53844E.D.D.I (Enhanced Dialog Driven Interface) is a middleware t…6.3
• CVE-2024-53845ESPTouch is a connection protocol for internet of things dev…6.6
• CVE-2024-53846OTP is a set of Erlang libraries, which consists of the Erla…5.5
• CVE-2024-53847The Trix rich text editor, prior to versions 2.1.9 and 1.3.3…5.1
• CVE-2024-53848check-jsonschema is a CLI and set of pre-commit hooks for js…7.1
• CVE-2024-53849editorconfig-core-c is theEditorConfig core library writte…4.8