Live › vulnerability › CVE-2026-37980
Go to dashboardKeycloak's organization selection login page puts the organization alias into an inline JavaScript onclick handler without escaping it. An attacker with manage-realm or manage-organizations rights can store a script in the alias that runs in the browser of every user who opens that login page, enabling session theft and account actions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | <= 26.5.5 | – |
| redhat build of keycloak | vendor | – | – |
Look for organizations in the admin console whose alias contains quotes, angle brackets or script text; unknown whether a version check command is given by the sources.
26.5.5; the fixed version is not stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
This page as .md · .json · in your agent: get_signal("CVE-2026-37980")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.