CVE-2026-9086

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

• CWE-79
• CWE-79

• https://access.redhat.com/errata/RHSA-2026:30049Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30050Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30083Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30084Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-9086Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2480170Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30049Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30050Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30083Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:30084Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-9086Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2480170Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9086.jsonThird Party Advisory

Published

Jun 25, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90852A vulnerability has been found in luben zstd-jni up to 1.5.7…7.3
• CVE-2026-90854A security flaw has been discovered in SourceCodester/katojk…7.3
• CVE-2026-90855A weakness has been identified in SourceCodester/katojkalemb…7.3
• CVE-2026-90856A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-90857A vulnerability was detected in SourceCodester College Notes…6.3
• CVE-2026-90858A flaw has been found in subhajitkhan online-clinic-manageme…7.3
• CVE-2026-90860The Canva Mobile App for HarmonyOS before v1.15.1 did not re…7.1
• CVE-2026-9087A flaw was found in Keycloak. The cross-session verification…8.1
• CVE-2026-90876A vulnerability has been found in SourceCodester Online Facu…7.3
• CVE-2026-90877A vulnerability was found in SourceCodester Online Faculty C…7.3
• CVE-2026-90878A vulnerability was determined in vllm-project vLLM up to 0.…4.3
• CVE-2026-90879A vulnerability was identified in zyx0814 FilePress up to 3.…7.3