Bug 2548355 (CVE-2026-107889)

Summary: CVE-2026-107889 keycloak-services: keycloak-services: Stored XSS on login page via kcSanitize bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-09 04:08:03 UTC 
A stored cross-site scripting (XSS) vulnerability was discovered in Keycloak's login theme rendering. The vulnerability stems from a bypass in the kcSanitize filter. While kcSanitize correctly identifies and neutralizes certain numeric character references, a subsequent post-processing function, fixURLs(), restores the ampersand encoding. This restoration re-activates the malicious character references before they are parsed by the browser.
An attacker with manage-realm permissions can exploit this by storing crafted HTML payloads in realm display fields like displayNameHtml or via localization overrides. Successful exploitation allows arbitrary JavaScript to execute in the context of any user loading the realm's login page. A specific variant on the WebAuthn error page allows for execution without any user interaction. An attacker could use this flaw to steal session tokens, perform actions on behalf of the user, or deface the login interface.