A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:30049 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30083 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30084 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-9086 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2480170 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30049 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30050 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30083 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30084 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-9086 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2480170 | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Jul 2026, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat build Of Keycloak
Redhat |
|
| References | () https://access.redhat.com/errata/RHSA-2026:30049 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30050 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30083 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2026:30084 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9086 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2480170 - Third Party Advisory | |
| References | () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json - Third Party Advisory | |
| CPE | cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:* |
30 Jun 2026, 03:21
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://access.redhat.com/errata/RHSA-2026:30049 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30050 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30083 - | |
| References | () https://access.redhat.com/errata/RHSA-2026:30084 - | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9086 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2480170 - |
26 Jun 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jun 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jun 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 17:17
Updated : 2026-07-15 01:17
NVD link : CVE-2026-9086
Mitre link : CVE-2026-9086
CVE.ORG link : CVE-2026-9086
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')