CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
References
- access.redhat.com/errata/RHSA-2026:30049
- access.redhat.com/errata/RHSA-2026:30050
- access.redhat.com/errata/RHSA-2026:30083
- access.redhat.com/errata/RHSA-2026:30084
- access.redhat.com/security/cve/CVE-2026-9086
- bugzilla.redhat.com/show_bug.cgi?id=2480170
- github.com/advisories/GHSA-v3f7-2p4r-mwfw
- github.com/keycloak/keycloak/security/advisories/GHSA-v3f7-2p4r-mwfw
- nvd.nist.gov/vuln/detail/CVE-2026-9086
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.json
Code Behaviors & Features
Detect and mitigate CVE-2026-9086 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →