This vulnerability involves improper neutralization of input in the organization selection login page of Red Hat Build of Keycloak. Specifically, the organization.alias value is inserted into an inline JavaScript onclick handler without proper sanitization, enabling stored XSS attacks. An attacker with elevated administrative privileges can craft a payload that executes arbitrary JavaScript in the context of users viewing the login page. This can lead to session hijacking or unauthorized actions within the affected realm. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with high confidentiality impact and low integrity impact.

Successful exploitation allows arbitrary JavaScript execution in the victim's browser when viewing the login page, potentially leading to session theft, unauthorized account actions, or further attacks against users within the affected realm. The attack requires the attacker to have administrative privileges (manage-realm or manage-organizations) and user interaction (victim must view the login page). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-37980 for current remediation guidance. Until a fix is available, restrict administrative privileges to trusted users only and consider additional monitoring of administrative actions. Avoid exposing the vulnerable login page to untrusted users where possible.