CVE-2026-37980

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

CVSS 3.1

4.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-04-14

Modified

2026-10-22

Record from

the NVD, synced 2026-10-23

Affected

• redhat:build_of_keycloak

Packages (OSV)

References

• https://access.redhat.com/errata/RHSA-2026:19596
• https://access.redhat.com/security/cve/CVE-2026-37980
• https://bugzilla.redhat.com/show_bug.cgi?id=2455325

Check your stackJSON