CVE-2026-37980
Last modified
CVE-2026-37980 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Build Of Keycloak | All versions |
References
- https://access.redhat.com/security/cve/CVE-2026-37980Mitigation, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455325Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-37980?
How severe is CVE-2026-37980?
How do I fix CVE-2026-37980?
Are you affected by CVE-2026-37980?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST