---
id: "CVE-2026-9086"
kind: "vulnerability"
aliases: ["CVE-2026-9086", "GHSA-v3f7-2p4r-mwfw"]
title: "Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass"
severity: "high"
cvss: 7.3
epss: 0.00781
exploited: false
status: "open"
category: "package"
products: [{"name": "org.keycloak:keycloak-services", "fixed": ["26.6.4"], "affected": "< 26.6.4", "ecosystem": "maven"}, {"name": "redhat build of keycloak", "fixed": ["26.4.13"], "affected": ">= 26.4, < 26.4.13", "ecosystem": "vendor"}, {"name": "redhat build of keycloak", "fixed": ["26.6.4"], "affected": ">= 26.6, < 26.6.4", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-79", "identity", "java", "keycloak", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-client-registration-access"]
published_at: "2026-06-25T17:17:03+00:00"
first_seen_at: "2026-10-29T16:44:11+00:00"
updated_at: "2026-10-29T16:56:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-v3f7-2p4r-mwfw", "first_seen_at": "2026-10-29T16:44:11+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9086", "first_seen_at": "2026-10-29T16:56:32+00:00"}]
---

# Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can carry script. When a victim clicks a crafted link, such as in the logout flow or Admin Console, the script runs in the Keycloak origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.keycloak:keycloak-services affected < 26.6.4 fixed 26.6.4
- vendor:redhat build of keycloak affected >= 26.4, < 26.4.13 fixed 26.4.13
- vendor:redhat build of keycloak affected >= 26.6, < 26.6.4 fixed 26.6.4

## How to check

- Check the Keycloak version with the server's startup log or admin console; affected if below `26.6.4`.
- Review registered clients for redirect URIs containing `javascript:` or `data:` in any letter case.
- Confirm who holds `manage-client` permission or access to client registration endpoints.

## Fix

- Move Keycloak to `26.6.4`.

## Timeline

- 2026-10-29T16:44:11+00:00 ghsa https://github.com/advisories/GHSA-v3f7-2p4r-mwfw
- 2026-10-29T16:56:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9086

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-v3f7-2p4r-mwfw
- [advisory] Maintainer's advisory: github.com https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30049
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30050
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30083
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30084
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/security/cve/CVE-2026-9086
- [advisory] Third-party advisory: bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2480170
- [advisory] Third-party advisory: security.access.redhat.com https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json

## From the sources

### Description
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_