CVE-2026-9086

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An issue exists where a remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, can bypass client Uniform Resource Identifier (URI) validation. By registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme, the attacker can trigger Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. This allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as during the logout flow or within the Admin Console.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.