Live › vulnerability › CVE-2026-9086
Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can carry script. When a victim clicks a crafted link, such as in the logout flow or Admin Console, the script runs in the Keycloak origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:44 UTC, 0h before NVD. All times on this page are UTC.
Deployments of Keycloak below 26.6.4 where someone with manage-client permission or client registration access can create clients. Exposure depends on who holds those rights; a server where only trusted administrators can register clients carries less risk. Teams on 26.6.4 or later are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | 26.6.4 |
| redhat build of keycloak | vendor | >= 26.4, < 26.4.13 | 26.4.13 |
| redhat build of keycloak | vendor | >= 26.6, < 26.6.4 | 26.6.4 |
26.6.4.javascript:data:manage-client permission or access to client registration endpoints.26.6.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
This page as .md · .json · in your agent: get_signal("CVE-2026-9086")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.