CVE-2026-9086: Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-07-15
Weakness: CWE-79

Description

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Affected products

Red Hat build of Keycloak 26.4: from 26.4 before 26.4.13; from 26.6 before 26.6.4 — fixed in 26.4.13, 26.6.4

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4.13, 26.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-9086 or the next vulnerability affects your stack