{"id":"CVE-2026-9086","kind":"vulnerability","aliases":["CVE-2026-9086","GHSA-v3f7-2p4r-mwfw"],"related":[],"title":"Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass","description":"### Description\nA flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.","summary":"Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can carry script. When a victim clicks a crafted link, such as in the logout flow or Admin Console, the script runs in the Keycloak origin.","severity":"high","cvss":7.3,"epss":0.00781,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":["26.6.4"],"affected":"< 26.6.4","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":["26.4.13"],"affected":">= 26.4, < 26.4.13","ecosystem":"vendor"},{"name":"redhat build of keycloak","fixed":["26.6.4"],"affected":">= 26.6, < 26.6.4","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-79","identity","java","keycloak","package","self-hosted"],"not_affected_if":["fixed-version","no-client-registration-access"],"how_to_check":"- Check the Keycloak version with the server's startup log or admin console; affected if below `26.6.4`.\n- Review registered clients for redirect URIs containing `javascript:` or `data:` in any letter case.\n- Confirm who holds `manage-client` permission or access to client registration endpoints.","fix":"- Move Keycloak to `26.6.4`.","status":"open","published_at":"2026-06-25T17:17:03+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","triaged_at":"2026-10-29T16:46:01+00:00","updated_at":"2026-10-29T16:56:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:46:01Z","model":"claude-haiku-5-5","output":{"fix":"- Move Keycloak to `26.6.4`.","reach":"internet","title":"Keycloak: redirect URI check bypass enables script injection via admin-registered clients","impact":"high","summary":"Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can carry script. When a victim clicks a crafted link, such as in the logout flow or Admin Console, the script runs in the Keycloak origin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity","java"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in Keycloak origin, exposing admin sessions and tokens","analyst_note":"","how_to_check":"- Check the Keycloak version with the server's startup log or admin console; affected if below `26.6.4`.\n- Review registered clients for redirect URIs containing `javascript:` or `data:` in any letter case.\n- Confirm who holds `manage-client` permission or access to client registration endpoints.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-client-registration-access"],"who_is_affected":"Deployments of Keycloak below 26.6.4 where someone with manage-client permission or client registration access can create clients. Exposure depends on who holds those rights; a server where only trusted administrators can register clients carries less risk. Teams on 26.6.4 or later are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4326,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A '-79':40B '-9086':18A,26A '2p4r':22A 'access':117C 'achiev':132C 'admin':87B,184C 'administr':107C 'allow':160C 'arbitrari':162C 'attack':105C 'build':32A,36A 'bypass':15A,55B,123C 'carri':71B 'case':11A,60B,147C 'case-insensit':10A,146C 'click':76B,172C 'client':50B,69B,114C,119C,124C,137C 'code':163C 'consol':88B,185C 'could':122C 'craft':78B,141C,174C 'cross':5A,155C 'cross-sit':4A,154C 'cve':16A,24A 'cwe':39B 'data':63B,151C 'descript':96C 'endpoint':121C 'execut':164C 'flaw':98C 'flow':85B,181C 'found':100C 'ghsa':20A 'ghsa-v3f7-2p4r-mwfw':19A 'host':47B 'ident':41B 'identifi':127C 'insensit':12A,148C 'java':42B 'javascript':61B,149C 'keycloak':1A,29A,34A,38A,43B,48B,94B,102C,167C 'keycloak-services':28A 'link':79B,175C 'logout':84B,180C 'malici':136C 'manag':113C 'manage-cli':112C 'mix':59B 'mixed-cas':58B 'mwfw':23A 'of':33A,37A 'org.keycloak':27A 'origin':95B,168C 'packag':44B 'permiss':115C 'privileg':108C 'redhat':31A,35A 'redirect':64B,142C 'regist':68B,134C 'registr':120C 'remot':104C 'resourc':126C 'run':91B 'scheme':152C 'script':7A,72B,90B,157C 'self':46B 'self-host':45B 'services':30A 'site':6A,156C 'special':140C 'specif':109C 'uniform':125C 'uri':13A,51B,65B,128C,143C 'use':144C 'v3f7':21A 'valid':14A,52B,129C 'via':9A 'victim':75B,171C 'vulner':2A,159C 'xss':8A,158C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Keycloak below 26.6.4 where someone with manage-client permission or client registration access can create clients. Exposure depends on who holds those rights; a server where only trusted administrators can register clients carries less risk. Teams on 26.6.4 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-06-25T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v3f7-2p4r-mwfw","url":"https://github.com/advisories/GHSA-v3f7-2p4r-mwfw","severity":"high","published_at":"2026-10-29T16:39:03+00:00","modified_at":"2026-10-29T16:39:04+00:00","first_seen_at":"2026-10-29T16:44:11+00:00","fetched_at":"2026-10-29T16:44:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9086","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9086","severity":null,"published_at":"2026-06-25T17:17:03+00:00","modified_at":"2026-07-15T01:17:08+00:00","first_seen_at":"2026-10-29T16:56:32+00:00","fetched_at":"2026-10-29T16:56:32+00:00","note":null}],"documents":[{"id":17900,"url":"https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-v3f7-2p4r-mwfw","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17901,"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":18033,"url":"https://access.redhat.com/errata/RHSA-2026:30049","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18034,"url":"https://access.redhat.com/errata/RHSA-2026:30050","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18035,"url":"https://access.redhat.com/errata/RHSA-2026:30083","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18036,"url":"https://access.redhat.com/errata/RHSA-2026:30084","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18037,"url":"https://access.redhat.com/security/cve/CVE-2026-9086","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18038,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480170","title":"Third-party advisory: bugzilla.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: bugzilla.redhat.com"},{"id":18039,"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json","title":"Third-party advisory: security.access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: security.access.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}