CVE-2026-9086: CVE-2026-9086: Stored Cross-Site Scripting via Case-Sensitive URI Scheme Validation Bypass in Keycloak

The vulnerability stems from a case-sensitive URI scheme validation check in DefaultClientValidationProvider, allowing attackers with client registration or management permissions to inject javascript: or data: URIs using mixed-case characters. TL;DR Keycloak validates client URIs against dangerous schemes like 'javascript:' and 'data:' using case-sensitive string comparisons (String.equals()). Because web browsers treat URI schemes as case-insensitive per RFC 3986, an attacker with client configuration privileges can bypass validation using mixed-case schemes (e.g., 'jaVaSCript:') to achieve stored Cross-Site Scripting (XSS) within the Keycloak security origin. ⚠️ Exploit Status: POC Technical Details Weakness Class: CWE-79 (Stored Cross-Site Scripting) Affected Component: DefaultClientValidationProvider (Keycloak Services) Attack Vector: Network (Admin REST API / Client Registration) CVSS v3.1 Score: 7.3 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) EPSS Score: 0.78% (55.86th Percentile) Exploit Status: Public PoC Available CISA KEV Status: Not Listed Affected Systems Keycloak Keycloak: < 26.6.4 (Fixed in: 26.6.4) Red Hat build of Keycloak: >= 26.4, < 26.4.13 (Fixed in: 26.4.13) Red Hat build of Keycloak: >= 26.6, < 26.6.4 (Fixed in: 26.6.4) Code Analysis Commit: 32cdceb Consider case-sensitivity when validating prohibited schemes of client URIs (#694) Closes #CVE-2026-9086 @@ -282,7 +335,7 @@ private void checkUri(FieldMessages field, String url, ValidationContext boolean valid = true; - if (uri.getScheme() != null && (uri.getScheme().equals("data") || uri.getScheme().equals("javascript"))) { + if (uri.getScheme() != null && (uri.getScheme().equalsIgnoreCase("data") || uri.getScheme().equalsIgnoreCase("javascript"))) { valid = false; } @@ -344,7 +397,7 @@ private void checkUriLogo(FieldMessages field, String url, ValidationContext - if (uri.getScheme() != null && uri.getScheme().equals("javascript")) { + if (uri.getScheme() != null && uri.getScheme().equalsIgnoreCase("javascript")) { Exploit Details GitHub: Public Proof-of-Concept Python script by reporter saku0512 demonstrating the mixed-case javascript: and data: URI validation bypass via the Keycloak Admin REST API.

Mitigation Strategies Upgrade Keycloak and Red Hat build of Keycloak instances to the patched maintenance releases. Restrict the 'manage-client' role to fully trusted administrative users to prevent delegated administrators from injecting malicious URIs. Disable anonymous Dynamic Client Registration and enforce strict Initial Access Token (IAT) requirements on client registration endpoints.

Audit existing database records in the 'redirect_uris' and 'client_attributes' tables for existing case-insensitive matches of 'javascript:' and 'data:' schemes. Remediation Steps: Identify all deployed Keycloak instances running versions prior to 26.6.4 (or Red Hat build of Keycloak prior to 26.4.13 and 26.6.4). Apply upstream version 26.6.4 or Red Hat errata advisories RHSA-2026:30049, RHSA-2026:30050, RHSA-2026:30083, or RHSA-2026:30084.

Execute a database or Admin API audit across all realms using the case-insensitive regular expression '(?i)^(javascript|data):' against client redirect URIs, post-logout URIs, logo URIs, and admin URLs. Remove or sanitize any identified anomalous client configurations and rotate administrative credentials if compromise is suspected. Restart or redeploy Keycloak instances after modifying configuration or client registration policies.

References Red Hat CVE-2026-9086 Security Page Red Hat Security Advisory: RHSA-2026:30049 Red Hat Security Advisory: RHSA-2026:30050 Red Hat Security Advisory: RHSA-2026:30083 Red Hat Security Advisory: RHSA-2026:30084 Red Hat Bugzilla #2480170 Red Hat CSAF VEX Data for CVE-2026-9086 CVE.org Record: CVE-2026-9086 NVD Detail: CVE-2026-9086 Keycloak Fix Commit 32cdceb80aeb43dc082bb032a87daa5105ea1fbd Keycloak GitHub Issue / PR #50347 GitHub Proof of Concept Repository by saku0512 Read the full report for CVE-2026-9086 on our website for more details including interactive diagrams and full exploit analysis.