EUVD-2026-22294
GHSA-m32f-8vh9-2hh3
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 43 maven packages depend on org.keycloak:keycloak-services (15 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.5.
DescriptionCVE.org
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
AnalysisAI
Stored XSS in Keycloak's organization selection login page allows authenticated administrators with manage-realm or manage-organizations privileges to inject malicious JavaScript via the organization.alias field, enabling arbitrary script execution in users' browsers when they access the login page. Exploitation requires high-privilege administrative access and user interaction (viewing the login page), with potential impact including session theft and unauthorized account actions. No public exploit code or active exploitation confirmed at time of analysis.
Technical ContextAI
Keycloak's organization selection login page implements a dynamic onclick handler that directly embeds the organization.alias value into inline JavaScript without proper sanitization or encoding. This violates output encoding requirements for JavaScript contexts and constitutes a Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The vulnerability exists in the authentication flow where realm organizations are rendered client-side; an attacker with administrative privileges can craft a malicious organization alias containing JavaScript code that persists in Keycloak's configuration. When any user navigates to the organization selection page, the stored payload executes in their browser context, inheriting their session privileges and authentication state.
RemediationAI
Apply the security patch provided by RedHat via the security advisory at https://access.redhat.com/security/cve/CVE-2026-37980. The primary fix involves sanitizing or encoding the organization.alias value before inserting it into the inline onclick handler-specifically, ensuring all JavaScript-context output is properly escaped or using a templating mechanism that prevents injection. As a temporary workaround pending patch deployment, audit and restrict manage-realm and manage-organizations role assignments to highly trusted administrators, and monitor organization alias modifications for suspicious patterns. Confirm patch application by verifying that organization.alias no longer executes injected JavaScript in the login page.
More in Build Of Keycloak
View allA misconfiguration flaw was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploita
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
Privilege escalation in Red Hat Build of Keycloak allows low-privileged authenticated users to assume the permissions of
Keycloak's IdentityBrokerService.performLogin endpoint fails to enforce disabled Identity Provider restrictions, allowin
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. Rated high severity (CVSS
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. Ra
Refresh token replay in Keycloak allows a remote attacker who has previously captured a user's refresh token to reuse th
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows administrative users with the manag
A vulnerability was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no
An open redirect vulnerability was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely e
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today