Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security vulnerability in its organization selection login page allows an administrative user to inject malicious scripts. If exploited, this could allow an attacker to steal user sessions, perform unauthorized actions on behalf of users, or compromise the accounts of anyone visiting the login page.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Keycloak's organization selection login page. The root cause is the improper neutralization of the 'organization.alias' attribute when it is placed into an inline JavaScript 'onclick' handler. Because browser HTML decoding occurs before the script execution, it bypasses FreeMarker's standard HTML escaping. A remote attacker with 'manage-realm' or 'manage-organizations' privileges can set a malicious alias that executes arbitrary JavaScript in the context of any user who views the login page. This can lead to session hijacking and unauthorized account manipulation within the affected realm.
Affected products
- Red Hat Keycloak unspecified
Timeline
- 2026-04-06: other: Reported to Red Hat Bugzilla
- 2026-04-14: disclosed: CVE published