CVE-2026-9086
Description
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
How to fix
- redhat build_of_keycloak26.4.13, 26.6.4 or later
- org.keycloak:keycloak-services26.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build_of_keycloak | 26.4 ≤ v < 26.4.13, 26.6 ≤ v < 26.6.4 | 26.4.13, 26.6.4 |
| org.keycloak:keycloak-servicesMaven | v < 26.6.4 | 26.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.