CVE-2026-9086: Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9086?
The severity of CVE-2026-9086 is rated high with a score of 7.3.
How do I fix CVE-2026-9086?
To fix CVE-2026-9086, ensure that you apply the latest security patches for Keycloak that address this vulnerability.
What type of vulnerability is CVE-2026-9086?
CVE-2026-9086 is a cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2026-9086?
A remote attacker with administrative privileges, particularly those with the 'manage-client' permission, can exploit CVE-2026-9086.
What impact does CVE-2026-9086 have on Keycloak?
CVE-2026-9086 allows an attacker to bypass client URI validation, potentially leading to the registration of malicious clients.