Keycloak stored XSS via case-sensitive URI scheme validation bypass
CVE-2026-9086 (CVSS 7.3) is a stored XSS flaw in Keycloak and Red Hat build of Keycloak: case-sensitive scheme checks let users with client management rights inject javascript: or data: URIs using mixed-case characters. It is fixed in Keycloak 26.6.4 and Red Hat build of Keycloak 26.4.13/26.6.4, and a public PoC exists.
- CVE-2026-9086 is a stored XSS rated 7.3 on CVSS
- Bypass uses mixed-case schemes like jaVaSCript: and DaTa:
- Fixed in Keycloak 26.6.4 and Red Hat build 26.4.13/26.6.4
- Public PoC script exploits the Admin REST API
Read next
Security