Does this exploit require the page with the specially crafted link to be on the host secured by Keycloak?