CVE-2026-9086: Keycloak XSS via case-insensitive URI validation bypass

CVE-2026-9086 · Severity: high · CVSS 7.3 · Published 2026-06-25

Keycloak, an open-source identity and access management solution, is vulnerable to a security flaw that allows administrative users to bypass safety checks. By creating malicious links, an attacker can execute unauthorized code in the browser of other users, including other administrators. This could lead to the theft of sensitive session information or unauthorized actions being performed within the management console.

Technologies: org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-9086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9086 being exploited in the wild.
How severe is CVE-2026-9086?
High severity, with a CVSS score of 7.3, published 25 June 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4; Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-9086?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9086 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9086?
Check whether you run org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later
    # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Keycloak due to improper neutralization of input during client URI validation (CWE-79). An attacker with 'manage-client' permissions or access to client registration endpoints can bypass validation by using case-insensitive 'javascript:' or 'data:' schemes in redirect URIs. When a victim interacts with these crafted URIs—for instance, during a logout flow or within the Admin Console—arbitrary JavaScript executes in the Keycloak origin. This allows for session hijacking or unauthorized administrative actions. The vulnerability is tracked as CVE-2026-9086.

Affected products

  • Red Hat Keycloak unspecified
  • Red Hat Red Hat Build of Keycloak unspecified

Identifiers

  • CVE-2026-9086
  • BIT-KEYCLOAK-2026-9086
  • GHSA-v3f7-2p4r-mwfw

Timeline

  • 2026-05-20: other: Reported to Red Hat Bugzilla
  • 2026-06-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.