The vulnerability CVE-2026-9086 in Red Hat build of Keycloak 26.4 allows a remote attacker with administrative privileges (specifically those with 'manage-client' permission or access to client registration endpoints) to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI that uses a case-insensitive javascript: or data: scheme, leading to Cross-Site Scripting (XSS). The XSS vulnerability enables arbitrary code execution within the Keycloak origin when a victim clicks the crafted link, for example during logout flows or when using the Admin Console. The affected versions are all releases before 26.4.13. Red Hat has published security advisories and released version 26.4.13 containing fixes for this and multiple other vulnerabilities. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker with administrative privileges and specific permissions to execute arbitrary code in the context of the Keycloak origin via Cross-Site Scripting. This can lead to compromise of administrative sessions or unauthorized actions within the Keycloak environment. The vulnerability does not affect availability. There are no known exploits in the wild currently.

Red Hat has released version 26.4.13 of the Red Hat build of Keycloak which addresses this vulnerability along with other security issues. Users should upgrade to version 26.4.13 or later to remediate this vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. No temporary or alternative mitigations are specified in the vendor advisory.