6.9
Moyenne
CVE-2026-37980 A flaw was found in Keycloak, specifically in the organization selection login page
Description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Keycloak 26.4.12 | Versions non publiées |
Références
- RHSA-2026:19596 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2455325 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Build of Keycloak
Les 276 CVE de Red Hat Build of Keycloak →
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Moyenne
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Moyenne