Bug 2455325 (CVE-2026-37980)

Summary: CVE-2026-37980 org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-06 07:51:41 UTC 
Stored Cross-Site Scripting (XSS) vulnerability in the organization selection login page of Keycloak. The flaw is caused by placing organization.alias into an inline JavaScript onclick handler, where browser HTML decoding bypasses FreeMarker’s HTML escaping. When an attacker-controlled alias containing a crafted JavaScript payload is rendered on the organization selection page, the payload can execute in the context of any user’s browser. This can be exploited remotely by an admin with manage-realm or manage-organizations privileges, without further user interaction beyond viewing the login page. Successful exploitation allows execution of arbitrary JavaScript, enabling session theft, account actions, or further attacks against users of the affected realm.