CVE-2026-107889 in Keycloak
Summary
by MITRE • 10/09/2026
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Keycloak represents a significant security risk stemming from an insufficient input validation mechanism in its authentication theme rendering component. Specifically, the security filter designed to sanitize user-supplied content before it is rendered on the login interface fails to adequately process certain inputs provided by realm administrators. This bypass allows malicious scripts to be persisted within display fields that are subsequently served to end-users during the authentication process. The core technical flaw lies in the sanitization logic not covering all potential injection vectors, particularly those associated with dynamic content generation for custom themes or localized text fields managed by administrative users.
From a classification perspective, this vulnerability aligns closely with CWE-79, which denotes Cross-Site Scripting (XSS). More specifically, it is an instance of Stored XSS because the malicious payload is saved on the server-side configuration and then retrieved and executed in the context of other users' browsers without further sanitization. This persistence distinguishes it from reflected variants, as the attack vector remains active until the stored data is manually removed or overwritten by a legitimate update to the theme settings.
The operational impact of this flaw is severe due to the privileged position of realm administrators within Keycloak's architecture. An attacker with administrative privileges can inject JavaScript code that executes in the browser sessions of users attempting to log into any application protected by that specific Keycloak realm. This execution occurs in a trusted context, meaning the malicious script inherits the same origin permissions as legitimate authentication pages. Consequently, attackers can perform session hijacking by stealing sensitive cookies such as access tokens or refresh tokens, which are critical for maintaining authenticated sessions. Furthermore, the attacker could manipulate the login interface to phish credentials directly from users, capture keystrokes entered into username and password fields, or redirect users to malicious external sites designed to exploit other vulnerabilities in their browsers or connected services.
This vulnerability maps to several techniques within the MITRE ATT&CK framework. It is primarily associated with T1059, Command and Scripting Interpreter, specifically through JavaScript execution in a web browser context. Additionally, it relates to T1556, Modification of Authentication Process, as the attacker alters the standard authentication flow to intercept credentials or session tokens. The ability for an administrator to inject these scripts also touches upon T1078, Valid Accounts, since the initial access requires legitimate administrative credentials that have been compromised or misused.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately review all custom theme configurations and localized text fields for any unexpected script tags or event handlers such as onload or onclick attributes. If possible, upgrading to a patched version of Keycloak where the input sanitization filter has been hardened is the most effective solution. In environments where immediate patching is not feasible, implementing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, although this may interfere with legitimate theme functionality and requires careful tuning. Additionally, enforcing principle of least privilege for realm administrators reduces the attack surface by ensuring that only highly trusted individuals have access to modify authentication themes or display content. Regular security audits of administrative actions and input validation logic across all user-facing components are essential to prevent similar bypasses in future updates.