EUVD-2026-95478
GHSA-gv8g-wx99-6r59
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Stored XSS planted by a realm administrator (PR:H), executing in other users' browsers via the login page (S:C, UI:N), with limited C/I impact and no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
AnalysisAI
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated realm administrator (PR:H) who can reach display fields rendered by the login theme and who can bypass the security filter that sanitizes user input; the malicious script is stored and later executes when any user visits the affected realm's login page (no additional victim interaction beyond normally loading the login page, per UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority issue rather than a high-urgency crisis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data, so remediation should begin by monitoring the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107889 and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2548355 and applying the fixed Red Hat Build of Keycloak or RH-SSO 7 build as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today