Keycloak: Schwachstelle ermöglicht Cross-Site Scripting

Summary

Product

Vulnerabilities 1

• Medium 6.9
  CVE-2026-37980

  Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

  A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs beca…

  Red Hat Red Hat Build of Keycloak Red Hat build of Keycloak 26.4.12 org.keycloak:keycloak-services Wolfi Maven
  Apr 14, 2026

Revision history

1. 2026-05-19 #2

   Neue Updates aufgenommen

2. 2026-04-14 #1

   Initiale Fassung

References

• RedHat Customer Portal vom 2026-04-14
  https://access.redhat.com/security/cve/cve-2026-37980
• Red Hat Bugtracker #2455325 vom 2026-04-14
  https://bugzilla.redhat.com/show_bug.cgi?id=2455325
• GitHub Advisory GHSA-M32F-8VH9-2HH3 vom 2026-04-14
  https://github.com/advisories/GHSA-M32F-8VH9-2HH3
• EUVD-2026-22294 vom 2026-04-14
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-22294
• Keycloak 26.6.2 release vom 2026-05-19
  https://www.keycloak.org/2026/05/keycloak-2662-released