REDHAT-BUG-2455325: XSS

Stored Cross-Site Scripting (XSS) vulnerability in the organization selection login page of Keycloak. The flaw is caused by placing organization.alias into an inline JavaScript onclick handler, where browser HTML decoding bypasses FreeMarker’s HTML escaping. When an attacker-controlled alias containing a crafted JavaScript payload is rendered on the organization selection page, the payload can execute in the context of any user’s browser. This can be exploited remotely by an admin with manage-realm or manage-organizations privileges, without further user interaction beyond viewing the login page. Successful exploitation allows execution of arbitrary JavaScript, enabling session theft, account actions, or further attacks against users of the affected realm.