CVE-2026-37980: Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Other sources
Stored Cross-Site Scripting (XSS) vulnerability in the organization selection login page of Keycloak. The flaw is caused by placing organization.alias into an inline JavaScript onclick handler, where browser HTML decoding bypasses FreeMarker’s HTML escaping. When an attacker-controlled alias containing a crafted JavaScript payload is rendered on the organization selection page, the payload can execute in the context of any user’s browser. This can be exploited remotely by an admin with manage-realm or manage-organizations privileges, without further user interaction beyond viewing the login page. Successful exploitation allows execution of arbitrary JavaScript, enabling session theft, account actions, or further attacks against users of the affected realm.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37980?
CVE-2026-37980 has been classified as a high severity vulnerability.
How do I fix CVE-2026-37980?
To fix CVE-2026-37980, update your Keycloak installation to the latest patched version that addresses this vulnerability.
Who is affected by CVE-2026-37980?
Keycloak installations that allow unauthorized access to the organization selection login page are affected by CVE-2026-37980.
What type of vulnerability is CVE-2026-37980?
CVE-2026-37980 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2026-37980 be exploited remotely?
Yes, CVE-2026-37980 can be exploited remotely by an attacker with certain administrative privileges.