CVE-2026-9086 Details

A Cross-Site Scripting (XSS) vulnerability has been identified in Keycloak. This issue allows remote attackers with administrative privileges, specifically those holding 'manage-client' permissions or access to client registration endpoints, to bypass validation of client Uniform Resource Identifiers (URIs). The vulnerability arises from the ability to register a malicious client using a specially crafted redirect URI that exploits case-insensitivity in 'javascript:' or 'data:' schemes. When a victim interacts with the crafted link, particularly during the logout process or within the Admin Console, it can execute arbitrary code in the Keycloak origin.

To address this vulnerability, restrict the ability to register new clients and manage existing client configurations. If Dynamic Client Registration is not needed, disable it in Keycloak's Realm Settings under Client Registration Policies. For necessary Dynamic Client Registration, configure policies to prevent anonymous client registration and require initial access tokens for all client registrations. Additionally, limit the 'manage-client' role to trusted administrators. Note that changes to Keycloak configuration may require a service restart or redeployment to take effect.