CVE-2026-107889: Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
Other sources
A stored cross-site scripting (XSS) vulnerability was discovered in Keycloak's login theme rendering. The vulnerability stems from a bypass in the kcSanitize filter. While kcSanitize correctly identifies and neutralizes certain numeric character references, a subsequent post-processing function, fixURLs(), restores the ampersand encoding. This restoration re-activates the malicious character references before they are parsed by the browser. An attacker with manage-realm permissions can exploit this by storing crafted HTML payloads in realm display fields like displayNameHtml or via localization overrides. Successful exploitation allows arbitrary JavaScript to execute in the context of any user loading the realm's login page. A specific variant on the WebAuthn error page allows for execution without any user interaction. An attacker could use this flaw to steal session tokens, perform actions on behalf of the user, or deface the login interface.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs realm-management privileges, specifically manage-realm permissions, to store a crafted payload in realm display fields or localization overrides. It is not described as exploitable by an unauthenticated attacker without administrative access.
Which users are exposed to the injected script?
Any user whose browser loads the affected realm's login page can have arbitrary JavaScript executed in that page's context. The described impact includes potential data exposure and session interference.
Where can an administrator check for malicious stored content?
Review realm display fields such as displayNameHtml and any localization overrides for crafted HTML or encoded character-reference payloads. The issue involves payloads that become active after kcSanitize processing and subsequent URL post-processing.