{"id":"GHSA-37j9-56gh-j2r7","kind":"vulnerability","aliases":["GHSA-37j9-56gh-j2r7"],"related":[],"title":"Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-v3f7-2p4r-mwfw. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.","summary":"Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can run script in the Keycloak origin. The sources say an attacker with manage-client rights or client registration access can plant the link, and a victim who clicks it (for example in the logout flow or the Admin Console) runs the attacker's code.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":[],"affected":"< 26.6.4","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-79","java","keycloak","package","self-hosted"],"not_affected_if":["keycloak-26.6.4-or-later","no-client-registration-access"],"how_to_check":null,"fix":"- `maven:org.keycloak:keycloak-services` affected below `26.6.4`; the sources do not name a separate fixed version for other branches\n- Withdrawn duplicate; see GHSA-v3f7-2p4r-mwfw for the live advisory","status":"withdrawn","published_at":"2026-06-25T18:30:41+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:55+00:00","updated_at":"2026-10-29T16:39:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:39:55Z","model":"claude-haiku-5-5","output":{"fix":"- `maven:org.keycloak:keycloak-services` affected below `26.6.4`; the sources do not name a separate fixed version for other branches\n- Withdrawn duplicate; see GHSA-v3f7-2p4r-mwfw for the live advisory","reach":"network","title":"Keycloak: case-insensitive URI check lets admins register script redirect links","impact":"high","summary":"Keycloak's client URI validation can be bypassed with a mixed-case javascript: or data: redirect URI, so a registered client can run script in the Keycloak origin. The sources say an attacker with manage-client rights or client registration access can plant the link, and a victim who clicks it (for example in the logout flow or the Admin Console) runs the attacker's code.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in the Keycloak origin when a victim clicks a crafted link","analyst_note":"Advisory is withdrawn as a duplicate; confirm the live advisory GHSA-v3f7-2p4r-mwfw for fix status and how_to_check details.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["keycloak-26.6.4-or-later","no-client-registration-access"],"who_is_affected":"Only Keycloak deployments where a user with manage-client rights or access to client registration endpoints can create clients. The sources do not describe a default-configuration exposure. Teams that restrict client registration to trusted administrators are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4350,"output_tokens":609,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-79':33B '2p4r':124C '37j9':20A,25A '56gh':21A,26A 'access':82B,156C 'achiev':171C 'admin':101B,223C 'administr':146C 'advisori':2A,109C,111C 'allow':199C 'arbitrari':201C 'attack':73B,105B,144C 'bypass':17A,47B,162C 'case':13A,52B,186C 'case-insensit':12A,185C 'click':91B,211C 'client':42B,61B,77B,80B,153C,158C,163C,176C 'code':107B,202C 'consol':102B,224C 'could':161C 'craft':180C,213C 'cross':7A,194C 'cross-sit':6A,193C 'cwe':32B 'data':55B,190C 'descript':135C 'duplic':1A,108C,119C 'endpoint':160C 'exampl':94B 'execut':203C 'extern':132C 'flaw':137C 'flow':98B,220C 'found':139C 'ghsa':19A,24A,122C 'ghsa-37j9-56gh-j2r7':18A,23A 'ghsa-v3f7-2p4r-mwfw':121C 'host':39B 'identifi':166C 'insensit':14A,187C 'j2r7':22A,27A 'java':34B 'javascript':53B,188C 'keycloak':3A,30A,35B,40B,67B,141C,206C 'keycloak-services':29A 'link':86B,127C,214C 'logout':97B,219C 'maintain':129C 'malici':175C 'manag':76B,152C 'manage-cli':75B,151C 'mix':51B 'mixed-cas':50B 'mwfw':125C 'org.keycloak':28A 'origin':68B,134C,207C 'packag':36B 'permiss':154C 'plant':84B 'preserv':131C 'privileg':147C 'redirect':56B,181C 'refer':133C 'regist':60B,173C 'registr':81B,159C 'remot':143C 'resourc':165C 'right':78B 'run':63B,103B 'say':71B 'scheme':191C 'script':9A,64B,196C 'self':38B 'self-host':37B 'services':31A 'site':8A,195C 'sourc':70B 'special':179C 'specif':148C 'uniform':164C 'uri':15A,43B,57B,167C,182C 'use':183C 'v3f7':123C 'valid':16A,44B,168C 'via':11A 'victim':89B,210C 'vulner':4A,198C 'withdrawn':114C 'xss':10A,197C","nicknames":[],"mitigations":[],"who_affected":"Only Keycloak deployments where a user with manage-client rights or access to client registration endpoints can create clients. The sources do not describe a default-configuration exposure. Teams that restrict client registration to trusted administrators are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-06-25T18:30:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-37j9-56gh-j2r7","url":"https://github.com/advisories/GHSA-37j9-56gh-j2r7","severity":"high","published_at":"2026-06-25T18:30:41+00:00","modified_at":"2026-10-29T16:38:50+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:44:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}