A vulnerability in the Keycloak server's client management component allows an authenticated attacker with client management permissions to upload a malicious JavaScript policy due to improper clearing of an internal session attribute. This flaw enables execution of arbitrary code on the server during authorization requests, potentially compromising the entire system. Exploitation requires elevated privileges and authenticated access. Red Hat rates this vulnerability as Important rather than Critical due to these requirements. No effective mitigation or patch is currently available.