HIGH 7.3 GitHub
CVE-2026-9086
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
### Description
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloa
Affected Products
- maven/org.keycloak:keycloak-services < 26.6.4
References
- https://github.com/advisories/GHSA-v3f7-2p4r-mwfw
- https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw
- https://nvd.nist.gov/vuln/detail/CVE-2026-9086
- https://access.redhat.com/errata/RHSA-2026:30049
This high severity vulnerability with a CVSS score of 7.3 was published on 2026-10-29 via GitHub. Affected: maven/org.keycloak:keycloak-services < 26.6.4.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.