CVE-2026-9086: CVE-2026-9086: Stored Cross-Site Scripting via Case-Sensitive URI Scheme Validation Bypass in Keycloak

#security #cve #cybersecurity

CVE-2026-9086: Stored Cross-Site Scripting via Case-Sensitive URI Scheme Validation Bypass in Keycloak

Vulnerability ID: CVE-2026-9086
CVSS Score: 7.3
Published: 2026-10-29

CVE-2026-9086 is a stored Cross-Site Scripting (XSS) vulnerability in Keycloak and the Red Hat build of Keycloak. The vulnerability stems from a case-sensitive URI scheme validation check in DefaultClientValidationProvider, allowing attackers with client registration or management permissions to inject javascript: or data: URIs using mixed-case characters.

TL;DR

Keycloak validates client URIs against dangerous schemes like 'javascript:' and 'data:' using case-sensitive string comparisons (String.equals()). Because web browsers treat URI schemes as case-insensitive per RFC 3986, an attacker with client configuration privileges can bypass validation using mixed-case schemes (e.g., 'jaVaSCript:') to achieve stored Cross-Site Scripting (XSS) within the Keycloak security origin.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: CVE-2026-9086
Weakness Class: CWE-79 (Stored Cross-Site Scripting)
Affected Component: DefaultClientValidationProvider (Keycloak Services)
Attack Vector: Network (Admin REST API / Client Registration)
CVSS v3.1 Score: 7.3 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
EPSS Score: 0.78% (55.86th Percentile)
Exploit Status: Public PoC Available
CISA KEV Status: Not Listed

Affected Systems

Keycloak
Red Hat build of Keycloak
Keycloak: < 26.6.4 (Fixed in: 26.6.4)
Red Hat build of Keycloak: >= 26.4, < 26.4.13 (Fixed in: 26.4.13)
Red Hat build of Keycloak: >= 26.6, < 26.6.4 (Fixed in: 26.6.4)

Code Analysis

Commit: 32cdceb

Consider case-sensitivity when validating prohibited schemes of client URIs (#694) Closes #CVE-2026-9086

@@ -282,7 +335,7 @@ private void checkUri(FieldMessages field, String url, ValidationContext<ClientM
             URI uri = new URI(urlToCheck);

             boolean valid = true;
-            if (uri.getScheme() != null && (uri.getScheme().equals("data") || uri.getScheme().equals("javascript"))) {
+            if (uri.getScheme() != null && (uri.getScheme().equalsIgnoreCase("data") || uri.getScheme().equalsIgnoreCase("javascript"))) {
                 context.addError(field.getFieldId(), field.getScheme(), field.getSchemeKey());
                 valid = false;
             }
@@ -344,7 +397,7 @@ private void checkUriLogo(FieldMessages field, String url, ValidationContext<Cli
         try {
             URI uri = new URI(url);

-            if (uri.getScheme() != null &&  uri.getScheme().equals("javascript")) {
+            if (uri.getScheme() != null &&  uri.getScheme().equalsIgnoreCase("javascript")) {
                 context.addError(field.getFieldId(), field.getScheme(), field.getSchemeKey());
             }

Exploit Details

GitHub: Public Proof-of-Concept Python script by reporter saku0512 demonstrating the mixed-case javascript: and data: URI validation bypass via the Keycloak Admin REST API.

Mitigation Strategies

Upgrade Keycloak and Red Hat build of Keycloak instances to the patched maintenance releases.
Restrict the 'manage-client' role to fully trusted administrative users to prevent delegated administrators from injecting malicious URIs.
Disable anonymous Dynamic Client Registration and enforce strict Initial Access Token (IAT) requirements on client registration endpoints.
Audit existing database records in the 'redirect_uris' and 'client_attributes' tables for existing case-insensitive matches of 'javascript:' and 'data:' schemes.

Remediation Steps:

Identify all deployed Keycloak instances running versions prior to 26.6.4 (or Red Hat build of Keycloak prior to 26.4.13 and 26.6.4).
Apply upstream version 26.6.4 or Red Hat errata advisories RHSA-2026:30049, RHSA-2026:30050, RHSA-2026:30083, or RHSA-2026:30084.
Execute a database or Admin API audit across all realms using the case-insensitive regular expression '(?i)^(javascript|data):' against client redirect URIs, post-logout URIs, logo URIs, and admin URLs.
Remove or sanitize any identified anomalous client configurations and rotate administrative credentials if compromise is suspected.
Restart or redeploy Keycloak instances after modifying configuration or client registration policies.

References

Read the full report for CVE-2026-9086 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community