Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-9086

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.13-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-19 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-19 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.13

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6.4-2 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-8 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-8 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6.4

Default version status: unaffected

References