Security advisory for GHSA-v3f7-2p4r-mwfw
GHSA-v3f7-2p4r-mwfw
Full advisory details, affected packages, severity context, and original source.
Affected technology
Advisory overview
### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
Affected packages and releases
Maven / org.keycloak:keycloak-services
1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, 1.0-alpha-3, 1.0-alpha-4, 1.0-beta-1, 1.0-beta-1-20150521, 1.0-beta-1-20150523
Also known as
BIT-keycloak-2026-9086 · CVE-2026-9086