All vulnerabilities
CVE-2026-37980GHSA-m32f-8vh9-2hh3

org.keycloak:keycloak-services: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

Red Hat org.keycloak:keycloak-servicesmavenIdentity & access
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Apr 2026Updated 22 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

Text from CVE List

Affected versions 52

  • org.keycloak:keycloak-services, maven<= 26.5.5GitHub
  • org.keycloak:keycloak-services, Mavenfrom first release, through 26.5.5OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-1-12062013OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-2OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-3OSV
  • org.keycloak:keycloak-services, Maven1.0-alpha-4OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150521OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-1-20150523OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-2OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-3OSV
  • org.keycloak:keycloak-services, Maven1.0-beta-4OSV
  • org.keycloak:keycloak-services, Maven1.0-finalOSV
  • org.keycloak:keycloak-services, Maven1.0-rc-1OSV
  • org.keycloak:keycloak-services, Maven1.0-rc-2OSV
  • org.keycloak:keycloak-services, Maven1.0.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.0.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.1.0.Beta2OSV
  • org.keycloak:keycloak-services, Maven1.1.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.1.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.2.0.Beta1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.2.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.3.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.4.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0-FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.5.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.6.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.7.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.7.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.0.Alpha1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR2OSV
  • org.keycloak:keycloak-services, Maven1.8.0.CR3OSV
  • org.keycloak:keycloak-services, Maven1.8.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.8.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.0.CR1OSV
  • org.keycloak:keycloak-services, Maven1.9.0.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.1.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.2.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.3.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.4.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.5.FinalOSV
  • org.keycloak:keycloak-services, Maven1.9.7.FinalOSV

References 6