HighVulnerabilityCVE-2026-9086updated 29 Oct 2026, 16:39 UTC

Keycloak lets admins register links that run hidden code in the login page

A user with admin rights on Keycloak (a login and identity system) could create a client with a booby-trapped web address. When someone clicks it, the code inside runs in the Keycloak site, potentially letting an attacker act as that user.

Fixed in 26.6.4Official source

Severity	HighCVSS 7.3 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes26.6.4 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Admin account abusedAttacker has manage-client permission or registration access
2Malicious client registeredRedirect URI uses javascript: or data: in mixed case
3Victim clicks linkLink triggers the crafted URI, such as in logout
4Script runs in KeycloakCode executes in the Keycloak origin
ResultAttacker runs code in the Keycloak origin

What happened

Keycloak's client URI validation fails to block case-insensitive javascript: and data: redirect URIs, enabling stored cross-site scripting in the Keycloak origin when a victim clicks a crafted link (for example in the logout flow or Admin Console).

Why it is dangerous: An attacker who can already manage clients can run arbitrary script in the Keycloak origin, which can expose sessions and admin actions to whoever clicks the link, including administrators.

Are you affected?

You are affected if you run Keycloak keycloak-services older than 26.6.4 and allow administrators or client-registration endpoints to create clients.

Package / product	Affected versions	Fixed in
org.keycloak:keycloak-services · maven	< 26.6.4	26.6.4

What to do

Update org.keycloak:keycloak-services to version 26.6.4 or later
Review existing clients for redirect URIs starting with javascript: or data: and remove them
Limit manage-client permission and client registration access to trusted administrators

Timeline

29 Oct 2026, 16:39 UTC
Publicly disclosed
29 Oct 2026, 16:39 UTC
Reported by GitHub Advisory · GitHub Advisory
29 Oct 2026, 16:39 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassGitHub Advisory · 29 Oct 2026, 16:39 UTC

Technical details

ID: CVE-2026-9086 · GHSA-v3f7-2p4r-mwfw
CVSS: 7.3 / 10
EPSS: 0.8% chance of exploitation within 30 days
Disclosed: 29 Oct 2026, 16:39 UTC
On Zero Radar: 29 Oct 2026, 16:39 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:39 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works