{"id":"CVE-2026-9086","aliases":["GHSA-v3f7-2p4r-mwfw"],"url":"https://o3.security/vulnerability/CVE-2026-9086","summary":"Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass","details":"A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.","published":"2026-08-25T11:42:40.305Z","modified":"2026-10-29T16:56:09.997771439Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Bitnami","name":"keycloak","fixedVersion":"26.4.13"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30049"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30050"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30083"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30084"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-9086"},{"type":"ADVISORY","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480170"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9086"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T16:56:09.997771439Z"}}