Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page (Red Hat Red Hat build of Keycloak 26.4.12)
En bref
- Source
- NVD
- EPSS
- EPSS 0.36 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 6.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-m32f-8vh9-2hh3 — Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Références européennes
- ENISA EUVD · EUVD-2026-22294
- GCVE · GCVE-0-2026-37980
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
Produits affectés
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |