A stored cross-site scripting (XSS) vulnerability exists in the login theme rendering component of Keycloak. This flaw allows a realm administrator to bypass the security filter that sanitizes user input, enabling the injection of malicious scripts into display fields. When users visit the affected login page, these scripts may execute in their browsers, potentially exposing data or interfering with user sessions. The vulnerability has a CVSS score of 5.5, indicating medium severity. A security update fixing this issue is available in Red Hat build of Keycloak version 26.6.8.