CVE-2026-107889
Received Received - Intake

Keycloak Login Theme Stored XSS Vulnerability

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: redhat-SADP

Description
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-107889
EUVD
EUVD-2026-95478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
keycloak keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Keycloak's login theme rendering component. A security filter meant to sanitize user input is bypassed, allowing a realm administrator to inject malicious scripts into display fields. When users visit the login page, their browsers execute these scripts, potentially exposing data or interfering with sessions.

Detection Guidance

To detect this vulnerability, inspect Keycloak login pages for unusual scripts in display fields like displayNameHtml or localization overrides. Check browser console logs for unexpected JavaScript errors or payloads. Review server logs for unauthorized modifications to realm settings by administrators.

Impact Analysis

An attacker with manage-realm permissions could inject scripts to steal session tokens, manipulate login interfaces, or execute unauthorized actions on behalf of users accessing the affected realm's login page. This could lead to data theft or session hijacking.

Compliance Impact

This vulnerability could lead to data exposure or session interference, which may violate compliance requirements under GDPR (e.g., unauthorized data access) and HIPAA (e.g., protected health information exposure). Attackers could steal session tokens or confidential information, potentially resulting in regulatory penalties.

Mitigation Strategies

Since mitigation options are unavailable per Red Hat, monitor Keycloak updates closely. Restrict manage-realm permissions to trusted administrators only. Temporarily disable custom login themes if possible. Use Content Security Policy (CSP) headers to limit script execution impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107889. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart