Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
Summary
| CVE | CVE-2026-9086 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-25 17:17:03 UTC |
| Updated | 2026-07-15 01:17:08 UTC |
| Description | A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console. |
Risk And Classification
Primary CVSS: v3.1 7.3 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
EPSS: 0.004190000 probability, percentile 0.337510000 (date 2026-07-04)
Problem Types: CWE-79 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | [email protected] | Secondary | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Build Of Keycloak | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4.13-1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4.13 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6.4-2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6.4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4.13-1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.4.13 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6.4-2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-8 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-8 * rpm | Not specified |
| ADP | Red Hat | Red Hat Build Of Keycloak 26.6.4 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:30084 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| access.redhat.com/security/cve/CVE-2026-9086 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:30050 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:30083 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:30049 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | Third Party Advisory |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank saku0512 for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-20T14:43:55.195Z | Reported to Red Hat. |
| CNA | 2026-06-25T15:58:33.359Z | Made public. |
| ADP | 2026-05-20T14:43:55.195Z | Reported to Red Hat. |
| ADP | 2026-06-25T15:58:33.359Z | Made public. |
Solutions
ADP: RHSA-2026:30050: Red Hat build of Keycloak 26.4
ADP: RHSA-2026:30084: Red Hat build of Keycloak 26.6
ADP: RHSA-2026:30049: Red Hat build of Keycloak 26.4.13
ADP: RHSA-2026:30083: Red Hat build of Keycloak 26.6.4
Workarounds
CNA: To mitigate this vulnerability, restrict the ability to register new clients and manage existing client configurations. If Dynamic Client Registration is not required, disable it in Keycloak's Realm Settings under Client Registration Policies. If Dynamic Client Registration is necessary, ensure that policies are strictly configured to prevent anonymous client registration and require initial access tokens for all client registrations. Additionally, limit the `manage-client` role to only trusted administrators. Changes to Keycloak configuration may require a service restart or redeployment to take effect.
ADP: To mitigate this vulnerability, restrict the ability to register new clients and manage existing client configurations. If Dynamic Client Registration is not required, disable it in Keycloak's Realm Settings under Client Registration Policies. If Dynamic Client Registration is necessary, ensure that policies are strictly configured to prevent anonymous client registration and require initial access tokens for all client registrations. Additionally, limit the `manage-client` role to only trusted administrators. Changes to Keycloak configuration may require a service restart or redeployment to take effect.