CVE-2026-37980
Description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Statement
This vulnerability has Moderate impact. A Stored Cross-Site Scripting (XSS) flaw in the organization selection login page of Red Hat Build of Keycloak (RHBK) allows an attacker with manage-realm or manage-organizations privileges to inject a crafted JavaScript payload. This payload executes in the context of a user's browser when the login page is viewed, potentially leading to session theft or further attacks.
Mitigation
Restrict access to the Keycloak administration console and login pages to trusted networks only, ideally through a VPN or by configuring firewall rules. Furthermore, ensure that only highly trusted administrators are granted `manage-realm` or `manage-organizations` privileges within Keycloak. Regularly review and audit administrative accounts and their assigned roles to minimize the risk of unauthorized access and exploitation. If the Keycloak service is restarted or reloaded, these network and access restrictions will persist.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.9 | 4.8 | 6.9 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | High | High | High |
| User Interaction | Required | Required | Required |
| Scope | Changed | Changed | Changed |
| Confidentiality | High | Low | High |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
