A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with
    `manage-client` permission or access to client registration endpoints, could bypass client Uniform
    Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially
    crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting
    (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the
    crafted link, such as in the logout flow or the Admin Console. (CVE-2026-9086)

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control     over the realm. (CVE-2026-9099)

  - An authentication bypass exists via JWT algorithm confusion, allowing unauthorized access.
    (CVE-2026-11800)

  - Any authenticated user can bypass all authorization policies, including role, scope, and UMA     permission checks, by including the configured access-denied page path within a request URL, gaining     unauthorized access to protected resources. (CVE-2026-9800)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
477916	SCA: security update for org.keycloak:keycloak-services (GHSA-v3f7-2p4r-mwfw)	Tenable Cloud Security	SCA Checks	Local	high
477916	SCA: security update for org.keycloak:keycloak-services (GHSA-v3f7-2p4r-mwfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324966	Keycloak < 26.6.4 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-9086

high

Tenable Plugins

high

high

high