Bug 2455325 (CVE-2026-37980) - CVE-2026-37980 org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Summary: CVE-2026-37980 org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code e...
Keywords:
Status: NEW
Alias: CVE-2026-37980
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-06 07:51 UTC by OSIDB Bzimport
Modified: 2026-04-14 14:41 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-06 07:51:41 UTC
Stored Cross-Site Scripting (XSS) vulnerability in the organization selection login page of Keycloak. The flaw is caused by placing organization.alias into an inline JavaScript onclick handler, where browser HTML decoding bypasses FreeMarker’s HTML escaping. When an attacker-controlled alias containing a crafted JavaScript payload is rendered on the organization selection page, the payload can execute in the context of any user’s browser. This can be exploited remotely by an admin with manage-realm or manage-organizations privileges, without further user interaction beyond viewing the login page. Successful exploitation allows execution of arbitrary JavaScript, enabling session theft, account actions, or further attacks against users of the affected realm.


Note You need to log in before you can comment on or make changes to this bug.