CVE-2026-9086 · GHSA-v3f7-2p4r-mwfw
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
- Risk score
- 60/100
- CVSS
- 7.3 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 25 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redi…
- Affected
- org.keycloak:keycloak-services (maven) < 26.6.4
- Fix
- Upgrade org.keycloak:keycloak-services to 26.6.4 or later.
- Exploitation
- No known exploitation
Story map
At a glance
org.keycloak:keycloak-services: Amber, patch this week. Keycloak Policy Enforcer has a flaw that allows any authenticated user to bypass authorization policies by including the access-denied page path in a request URL. This allows unauthorized access to protected resources.
The flaws
- CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass (CVSS 7.3 · EPSS 1%)
- CVE-2026-9800: Keycloak vulnerable to authorization bypass via incorrect uri comparison (CVSS 8.1 · EPSS 1%)
- CVE-2026-9705: Keycloak: Attacker can re-enable and take over disabled clients via registration access token (CVSS 6.5 · EPSS 0%)
- CVE-2026-9083: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing (CVSS 4.9 · EPSS 1%)
The fix
Fix: Upgrade to version 26.6.4 for keycloak-services or 26.0.10 for keycloak-policy-enforcer
Who is exposed: {'products': ['Keycloak'], 'packages': [{'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-services', 'vulnerable': '< 26.6.4'}, {'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-policy-enforcer', 'vulnerable': '< 26.0.10'}]}
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
- Same product: Earlier org.keycloak:keycloak-services warnings. 1 in the last 90 days
Why it is Amber
- CVSS 7.3 high
- On your watchlist: Maven
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | 26.6.4 |
References
- https://github.com/advisories/GHSA-v3f7-2p4r-mwfw
- https://github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw
- https://nvd.nist.gov/vuln/detail/CVE-2026-9086
- https://access.redhat.com/errata/RHSA-2026:30049
- https://access.redhat.com/errata/RHSA-2026:30050
- https://access.redhat.com/errata/RHSA-2026:30083
- https://access.redhat.com/errata/RHSA-2026:30084
- https://access.redhat.com/security/cve/CVE-2026-9086
- https://bugzilla.redhat.com/show_bug.cgi?id=2480170
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json
Original description
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
Last activity 29 Oct 2026. Patch Forecast updates every hour.