EUVD-2026-39473
GHSA-37j9-56gh-j2r7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network XSS needs prior client-management privilege (PR:L) and a victim click (UI:R); script runs in the Keycloak origin affecting other sessions, so I assess S:C with high confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
AnalysisAI
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with manage-client permission (or access to client registration endpoints) register a malicious client whose redirect URI uses a case-insensitive javascript: or data: scheme, bypassing URI validation. When a victim later clicks a crafted link - for example during the logout flow or within the Admin Console - the script executes in the Keycloak origin, enabling session/token theft and effective code execution in that trusted context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it carries a CVSS 7.3 (PR:L, UI:R).
Technical ContextAI
Keycloak is a widely used open-source identity and access management server (the upstream of Red Hat Build of Keycloak) implementing OAuth 2.0/OpenID Connect, where each registered client declares allowed redirect URIs that Keycloak validates before redirecting browsers during login, logout, and registration flows. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the redirect-URI validation logic only blocked dangerous URI schemes case-sensitively, so a scheme written as JavaScript:, JaVaScRiPt:, or a mixed-case Data: slipped past the deny-list and was later rendered/followed in a browser context within the Keycloak origin. Because the malicious URI executes script in Keycloak's own origin (which holds admin sessions, SSO cookies, and tokens), the XSS is effectively a pivot to code execution in the IdP's trusted context. The affected component per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak (version unspecified/all in the feed).
RemediationAI
No vendor-released patch version is identified in the provided data, so confirm and apply the fixed Red Hat Build of Keycloak release referenced in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-9086) and Bugzilla 2480170 (https://bugzilla.redhat.com/show_bug.cgi?id=2480170) as soon as it is published - these are the authoritative sources for the exact version. As compensating controls until patched: restrict who holds the manage-client role and lock down or disable the client registration endpoints (set client registration policies to deny anonymous/dynamic registration), since the attack requires that access - the trade-off is reduced self-service for legitimate client onboarding. Audit existing clients for redirect URIs containing javascript: or data: in any letter case and remove offending clients; enforce an allow-list of https: redirect URIs via client registration policies, accepting that custom-scheme native-app clients may need explicit exceptions. A strict Content-Security-Policy on the Keycloak Admin Console and account/logout pages (disallowing inline script execution) reduces XSS impact but may break customized themes and must be tested.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today