{"id":"CVE-2026-37980","kind":"vulnerability","aliases":["CVE-2026-37980","GHSA-m32f-8vh9-2hh3"],"related":[],"title":"Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page","description":"A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.","summary":"Keycloak's organization selection login page puts the organization alias into an inline JavaScript onclick handler without escaping it. An attacker with manage-realm or manage-organizations rights can store a script in the alias that runs in the browser of every user who opens that login page, enabling session theft and account actions.","severity":"medium","cvss":6.900000095367432,"epss":0.003819999983534217,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":[],"affected":"<= 26.5.5","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-79","java","keycloak","maven","package","self-hosted"],"not_affected_if":["no-organizations-in-use","version-above-26.5.5"],"how_to_check":"Look for organizations in the admin console whose alias contains quotes, angle brackets or script text; unknown whether a version check command is given by the sources.","fix":"Upgrade keycloak-services to a release newer than 26.5.5; the fixed version is not stated in the sources.\nUntil then, restrict manage-realm and manage-organizations to trusted admins and review existing organization aliases.","status":"open","published_at":"2026-04-14T15:16:34+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T21:45:58+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:45:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade keycloak-services to a release newer than 26.5.5; the fixed version is not stated in the sources.\nUntil then, restrict manage-realm and manage-organizations to trusted admins and review existing organization aliases.","reach":"internet","impact":"high","summary":"Keycloak's organization selection login page puts the organization alias into an inline JavaScript onclick handler without escaping it. An attacker with manage-realm or manage-organizations rights can store a script in the alias that runs in the browser of every user who opens that login page, enabling session theft and account actions.","category":"package","who_cares":["keycloak","self-hosted","java","maven"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs JavaScript in users' browsers, stealing sessions and acting as them.","analyst_note":"Confirm the fixed version and the patched release in GHSA-m32f-8vh9-2hh3 and the Keycloak advisory; the sources do not name it.","how_to_check":"Look for organizations in the admin console whose alias contains quotes, angle brackets or script text; unknown whether a version check command is given by the sources.\nunknown","needs_analyst":true,"not_affected_if":["no-organizations-in-use","version-above-26.5.5"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000535,"input_tokens":2966,"output_tokens":477,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A '-37980':19A,27A '-79':37B '2hh3':24A '8vh9':23A 'account':99B,181C 'action':100B,182C 'administr':125C 'affect':190C 'alia':54B,81B 'allow':151C 'arbitrari':2A,172C 'attack':65B,116C,185C 'browser':86B,162C 'build':33A 'code':3A 'craft':153C 'cross':8A,132C 'cross-sit':7A,131C 'cve':17A,25A 'cwe':36B 'enabl':95B,171C 'escap':62B 'everi':88B 'execut':4A,157C,174C 'exploit':128C,170C 'flaw':102C,138C 'found':104C 'ghsa':21A 'ghsa-m32f-8vh9-2hh3':20A 'handler':60B,150C 'host':44B 'inlin':57B,147C 'java':38B 'javascript':58B,148C,154C,173C 'keycloak':1A,30A,35A,39B,45B,106C 'keycloak-services':29A 'lead':176C 'login':15A,49B,93B,112C,167C 'm32f':22A 'manag':68B,72B,119C,123C 'manage-organ':71B,122C 'manage-realm':67B,118C 'maven':40B 'occur':139C 'of':34A 'onclick':59B,149C 'open':91B 'org.keycloak':28A 'organ':13A,47B,53B,73B,110C,124C 'organization.alias':142C 'packag':41B 'page':16A,50B,94B,113C,168C 'payload':155C 'place':144C 'potenti':175C 'privileg':126C 'put':51B 'realm':69B,120C,191C 'redhat':32A 'remot':115C 'right':74B 'run':83B 'script':10A,78B,134C 'select':14A,48B,111C 'self':43B 'self-host':42B 'services':31A 'session':96B,178C 'site':9A,133C 'specif':107C 'store':6A,76B,130C 'success':169C 'theft':97B,179C 'unauthor':180C 'user':89B,160C,187C 'via':5A 'view':165C 'vulner':136C 'without':61B 'xss':11A,135C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-14T15:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-m32f-8vh9-2hh3","url":"https://github.com/advisories/GHSA-m32f-8vh9-2hh3","severity":"medium","published_at":"2026-04-14T15:30:35+00:00","modified_at":"2026-10-22T21:33:03+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-37980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37980","severity":null,"published_at":"2026-04-14T15:16:34+00:00","modified_at":"2026-10-22T21:17:18+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}