Live › vulnerability › GHSA-37j9-56gh-j2r7
Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can run script in the Keycloak origin. The sources say an attacker with manage-client rights or client registration access can plant the link, and a victim who clicks it (for example in the logout flow or the Admin Console) runs the attacker's code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Only Keycloak deployments where a user with manage-client rights or access to client registration endpoints can create clients. The sources do not describe a default-configuration exposure. Teams that restrict client registration to trusted administrators are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | – |
Unknown from the sources.
maven:org.keycloak:keycloak-services affected below 26.6.4; the sources do not name a separate fixed version for other branchesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-v3f7-2p4r-mwfw. This link is maintained to preserve external references.
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
This page as .md · .json · in your agent: get_signal("GHSA-37j9-56gh-j2r7")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.