A stored cross-site scripting (XSS) vulnerability was discovered in Keycloak's login theme rendering. The vulnerability stems from a bypass in the kcSanitize filter. While kcSanitize correctly identifies and neutralizes certain numeric character references, a subsequent post-processing function, fixURLs(), restores the ampersand encoding. This restoration re-activates the malicious character references before they are parsed by the browser.
An attacker with manage-realm permissions can exploit this by storing crafted HTML payloads in realm display fields like displayNameHtml or via localization overrides. Successful exploitation allows arbitrary JavaScript to execute in the context of any user loading the realm's login page. A specific variant on the WebAuthn error page allows for execution without any user interaction. An attacker could use this flaw to steal session tokens, perform actions on behalf of the user, or deface the login interface.