The vulnerability in Red Hat Build of Keycloak involves improper neutralization of input during web page generation, specifically in the client registration process. An attacker with administrative privileges and the 'manage-client' permission or access to client registration endpoints can register a malicious client with a redirect URI that uses a case-insensitive 'javascript:' or 'data:' scheme. This bypasses URI validation and enables Cross-Site Scripting (XSS), allowing execution of arbitrary code in the context of the Keycloak origin when a victim clicks the crafted link. The CVSS 3.1 score is 7.3, indicating a high severity vulnerability. No patch or official remediation level is currently indicated in the vendor advisory.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary scripts in the context of the Keycloak origin. This can compromise confidentiality and integrity by executing malicious code during user interactions such as logout flows or within the Admin Console. The vulnerability requires privileges and user interaction, and does not impact availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9086 for current remediation guidance. Until a fix is available, restrict administrative privileges to trusted users and monitor client registrations for suspicious redirect URIs using javascript: or data: schemes. Avoid clicking untrusted links related to Keycloak logout or admin console flows.