CVE-2026-9086 Keycloak Client URI Validation Bypass XSS

Technical summary

CVE-2026-9086 is a client URI validation bypass in Keycloak that permits stored XSS attacks. The vulnerability stems from insufficient case-insensitive URI scheme validation during client registration. An authenticated attacker with `manage-client` permission or access to client registration endpoints can register a client with a redirect URI using case-insensitive variations of `javascript:` or `data:` schemes (e.g., `JavaScript:`, `jAvAsCrIpT:`, or case variants of `data:`). When a victim navigates to the logout flow or interacts with the Admin Console and triggers the redirect, the malicious URI executes arbitrary JavaScript in the Keycloak origin context. The CVSS 3.1 score of 7.3 reflects high confidentiality and integrity impact (CWE-79: Improper Neutralization of Input During Web Page Generation) moderated by the requirement for prior authentication and user interaction.

Business impact

A successful attack could result in credential harvesting, session hijacking, or privilege escalation within Keycloak. Attackers could steal OAuth tokens, OIDC credentials, or administrative session cookies, potentially compromising downstream applications that rely on Keycloak for authentication. In regulated environments, this could trigger compliance violations and incident reporting obligations. The reputational cost of a compromised identity provider is severe, as it affects trust across your entire application ecosystem.

Affected systems

Red Hat Build of Keycloak is confirmed affected. Organizations using upstream Keycloak or community builds should verify applicability against Red Hat's advisory, as the vulnerability likely affects multiple Keycloak versions. Any deployment where non-root users, service accounts, or delegated administrators have client registration or management capabilities should be considered at risk.

Exploitability

Exploitation requires two conditions: (1) the attacker must possess administrative or client-management privileges within Keycloak, and (2) a victim must click or be redirected to the malicious URI. This limits the attack surface compared to unauthenticated vulnerabilities, but internal threats, compromised admin accounts, or privilege escalation chains can satisfy the first condition. The case-insensitive URI bypass suggests minimal additional complexity once permissions are held. The vulnerability is not listed on the CISA KEV catalog, indicating no evidence of active exploitation in the wild at publication time.

Remediation

Apply the security patch released by Red Hat for Keycloak. Patch version numbers should be verified against the official Red Hat security advisory. As an interim control, restrict client registration and `manage-client` permissions to a minimal set of trusted administrators, audit existing client registrations for suspicious redirect URIs (especially those containing `javascript:` or `data:` in any case variation), and consider network controls limiting administrative access to the Keycloak Admin Console. Monitor logout flows and admin console access for anomalous redirection patterns.

Patch guidance

Check the Red Hat Keycloak security advisories for the specific patched version applicable to your deployment. Test patches in a staging environment to ensure compatibility with any custom client configurations or extensions. Prioritize patching systems where Keycloak serves as the primary identity provider for critical applications. Once patched, perform a URI validation audit of all registered clients to confirm the fix is effective and to identify any legacy malicious registrations.

Detection guidance

Monitor audit logs for client registration events with redirect URIs containing unusual scheme variations (case-insensitive `javascript:`, `data:`, etc.). Alert on unexpected modifications to existing clients, especially those adding or changing redirect URIs. In the Admin Console and logout flow logs, look for execution of inline scripts or unusual document property access patterns. Network-based detection should focus on outbound connections from Keycloak servers following logout or admin interactions, which may indicate credential exfiltration. Review security event logs for XSS-like patterns in request parameters.

Why prioritize this

This vulnerability merits high-priority remediation because: (1) Keycloak is often a critical identity infrastructure component with extensive downstream impact, (2) the XSS payload executes in the Keycloak origin, not a sandboxed context, allowing theft of sensitive tokens and cookies, (3) administrators and users are regularly exposed to logout flows and the Admin Console, increasing attack surface, and (4) once an attacker gains the required permissions—through credential compromise, insider threat, or privilege escalation—exploitation is straightforward and difficult to detect in real-time. Organizations should patch ahead of any signs of weaponization.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects high impact to confidentiality and integrity if exploited, balanced by the requirement for prior local authentication (PR:L) and user interaction (UI:R). The attack vector is network-based (AV:N) and requires low attack complexity (AC:L) once the attacker has permissions. Scope is unchanged (S:U), meaning the impact is limited to the Keycloak service itself, not other systems—though downstream applications may be indirectly compromised through stolen credentials. Organizations with sensitive applications or large user bases depending on Keycloak should treat this as a critical issue despite the score, due to the confidence and prevalence of identity provider attacks.

Frequently asked questions