What’s Vulnerable › Vulnerabilities

CVE-2026-37980: Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-14 · updated 2026-10-26
• Weakness: CWE-79

Description

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/errata/RHSA-2026:19596
• https://access.redhat.com/security/cve/CVE-2026-37980
• https://bugzilla.redhat.com/show_bug.cgi?id=2455325

Get alerted when CVE-2026-37980 or the next vulnerability affects your stack