GHSA-v3f7-2p4r-mwfw

Dashboard / Vulnerabilities / GHSA-v3f7-2p4r-mwfw

GHSA-v3f7-2p4r-mwfw

Summary: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Details: ### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

References: https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw, https://nvd.nist.gov/vuln/detail/CVE-2026-9086, https://access.redhat.com/errata/RHSA-2026:30049, https://access.redhat.com/errata/RHSA-2026:30050, https://access.redhat.com/errata/RHSA-2026:30083, https://access.redhat.com/errata/RHSA-2026:30084, https://access.redhat.com/security/cve/CVE-2026-9086, https://bugzilla.redhat.com/show_bug.cgi?id=2480170, https://github.com/keycloak/keycloak, https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json