← CVE Intelligence

CVE-2026-9086

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass PUBLISHED

Description (CNA)

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.13-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4.13unaffected
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6.4-2 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6.4unaffected

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.