# CVE-2026-120984: Keycloak server arbitrary code execution in client authorization

Source: https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-120984 · Severity: critical · CVSS 9.1 · Published 2026-11-07

Keycloak is an identity and access management server that handles authentication and authorization for applications. A flaw in its client management component allows an authenticated administrator to inject and execute malicious JavaScript code on the server, potentially compromising the entire system and any other applications or organizations relying on it. Exploitation requires an attacker with delegated client management permissions, but successful exploitation grants complete control over the server.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-120984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120984 being exploited in the wild.

**How severe is CVE-2026-120984?** Critical severity, with a CVSS score of 9.1, published 7 November 2026.

**Which products and versions are affected?** Red Hat build of Keycloak; Red Hat Single Sign-On; Keycloak Keycloak.

**Is there a fix for CVE-2026-120984?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120984 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120984?** Check whether you run Keycloak, Red Hat build of Keycloak or Red Hat Single Sign-On. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute during setup, allowing an authenticated attacker with client management permissions to bypass upload restrictions. The attacker can then upload a malicious JavaScript policy that executes on the server when authorization requests are processed, achieving arbitrary code execution within the application server process and potentially compromising realm boundaries in multi-tenant deployments.

## Affected products

- Red Hat build of Keycloak
- Red Hat Single Sign-On
- Keycloak Keycloak

## Timeline

- 2026-11-07: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-120984](https://access.redhat.com/security/cve/CVE-2026-120984)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)
- [Keycloak TokenManager identity rebinding in stateless token validation](https://junglewise.ai/threats/cve-2026-96447-a-flaw-was-found-in-the-tokenmanager-component-of-keycloak-an)