CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Description

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Timeline

Scores

EPSS (exploitation in 30 days)

0.78% · top 43% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4.13-1 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-19 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-19 – < *

• Red Hat · Red Hat build of Keycloak 26.4.13

  All versions: unaffected

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6.4-2 – < *

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6-8 – < *

• Red Hat · Red Hat build of Keycloak 26.6

  • unaffected 26.6-8 – < *

• Red Hat · Red Hat build of Keycloak 26.6.4

  All versions: unaffected

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.keycloak:keycloak-servicesGHSA-v3f7-2p4r-mwfw (opens in a new tab)

What to do

Workaround: To mitigate this vulnerability, restrict the ability to register new clients and manage existing client configurations. If Dynamic Client Registration is not required, disable it in Keycloak's Realm Settings under Client Registration Policies. If Dynamic Client Registration is necessary, ensure that policies are strictly configured to prevent anonymous client registration and require initial access tokens for all client registrations. Additionally, limit the `manage-client` role to only trusted administrators. Changes to Keycloak configuration may require a service restart or redeployment to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-39473 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-v3f7-2p4r-mwfw (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-9086](https://cveledger.app/badge/CVE-2026-9086.svg)](https://cveledger.app/cve/CVE-2026-9086)

Record last updated 15 Jul 2026, 00:38 UTC.