Vulnerability GHSA-v3f7-2p4r-mwfw
High Risk
HIGH RISK
CVSS Score: 7.3
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
1 day ago
October 29, 2026 at 04:39 PM UTC
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3
Summary
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Details
Description
A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 day ago
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-9jrw-8xf7-xqhq
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-9jrw-8xf7-xqhq
Medium Risk
1 day ago
Keycloak allows unauthorized access to resources via uma permission ticket bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
High Risk
1 day ago
Keycloak vulnerable to authorization bypass via incorrect uri comparison
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
Medium Risk
1 day ago
Keycloak: Attacker can re-enable and take over disabled clients via registration access token
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
Critical
2 months ago
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
26.0.0 - 26.7.1 GHSA-4gv3-mc9p-5wqc
26.0.0 - 26.7.1 GHSA-4gv3-mc9p-5wqc
Impacted packages
Timeline
Published
1 day ago
October 29, 2026 at 04:39 PM UTC
Fixed (26.6.4)
Unknown
Unknown
Last Modified
1 day ago
October 29, 2026 at 04:45 PM UTC