CVE-2026-37980: Keycloak Stored XSS Vulnerability

CVE-2026-37980 Overview

CVE-2026-37980 is a Stored Cross-Site Scripting (XSS) vulnerability in Keycloak's organization selection login page. The flaw exists because the organization.alias field is rendered inside an inline JavaScript onclick handler without proper sanitization. An authenticated attacker holding manage-realm or manage-organizations administrative privileges can inject a crafted JavaScript payload. The payload executes in the browser of any user who subsequently views the affected login page. The vulnerability is tracked under CWE-79 and was published to the National Vulnerability Database on April 14, 2026.

Critical Impact
Successful exploitation enables arbitrary JavaScript execution in victim browsers, leading to session theft, unauthorized account actions, and follow-on attacks against users of the affected realm.

Affected Products

Red Hat Keycloak (organization selection login page component)
Red Hat build of Keycloak
Red Hat Single Sign-On deployments incorporating the affected component

Discovery Timeline

2026-04-14 - CVE-2026-37980 published to NVD
2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-37980

Vulnerability Analysis

The vulnerability resides in how Keycloak renders the organization selection page during authentication flows. When a realm has multiple organizations configured, Keycloak displays a selection screen where each organization is represented by an interactive element. The organization.alias attribute is injected directly into an inline onclick JavaScript handler in the rendered HTML. Because the alias is not properly encoded for a JavaScript execution context, an administrator who creates or modifies an organization can embed JavaScript syntax within the alias value. The payload becomes persistent in the realm configuration and executes whenever an end user loads the organization selection login page.

Exploitation requires high privileges, specifically the manage-realm or manage-organizations role, and victim interaction with the login page. The attack crosses a trust boundary by allowing a realm administrator to compromise the browsers of end users in that realm, which may include users authenticating through federated identity flows.

Root Cause

The root cause is improper neutralization of input used in a JavaScript context [CWE-79]. Templating logic places the organization.alias value inside a JavaScript string literal in an onclick attribute without applying JavaScript-context encoding. HTML attribute encoding alone is insufficient when the data is later interpreted as code.

Attack Vector

The attack is network-based and requires an authenticated attacker with administrative privileges over realms or organizations. The attacker creates or updates an organization, setting organization.alias to a value containing a JavaScript breakout sequence. When any user reaches the organization selection login page, the injected script executes with the user's browser context for that origin. This permits theft of authentication artifacts, modification of pending login state, and pivoting to additional attacks against the realm's user base. Refer to the Red Hat CVE-2026-37980 Advisory and Red Hat Bugzilla Report #2455325 for technical details.

Detection Methods for CVE-2026-37980

Indicators of Compromise

Organization records in Keycloak with alias values containing characters such as ', ", <, >, or substrings like javascript:, onerror=, or </script>.
Unexpected outbound requests from end-user browsers originating from the Keycloak login origin to attacker-controlled domains.
Audit log entries showing manage-organizations or manage-realm operations from unfamiliar administrator accounts or unusual source IPs.

Detection Strategies

Review Keycloak admin event logs for CREATE and UPDATE operations on organization resources, focusing on the alias field contents.
Run static queries against the Keycloak database or Admin REST API to enumerate organization aliases and flag any value that does not match a strict identifier pattern such as ^[a-zA-Z0-9_-]+$.
Inspect rendered HTML of the organization selection page in a staging environment to confirm whether alias content appears within onclick handlers.

Monitoring Recommendations

Alert on changes to high-privilege role assignments, particularly grants of manage-realm and manage-organizations.
Monitor browser-reported Content Security Policy (CSP) violations from the Keycloak login origin, which can surface injected inline script execution attempts.
Correlate session anomalies, such as unexpected token refresh patterns, with recent organization configuration changes.

How to Mitigate CVE-2026-37980

Immediate Actions Required

Audit all existing organizations in every realm and remove or rename any alias value containing characters outside a safe identifier set.
Restrict assignment of manage-realm and manage-organizations roles to a minimal, vetted set of administrators.
Enable and enforce administrator multi-factor authentication on the Keycloak master realm and on tenant realms.

Patch Information

Apply the fixed Keycloak release referenced in the Red Hat CVE-2026-37980 Advisory. Red Hat tracks remediation status for affected products in Red Hat Bugzilla Report #2455325. Operators of self-hosted Keycloak should upgrade to the upstream version that includes the JavaScript-context encoding fix for the organization selection template.

Workarounds

Enforce input validation on organization creation workflows so that alias accepts only alphanumeric, hyphen, and underscore characters.
Deploy a strict Content Security Policy on the Keycloak login origin that disallows inline event handlers, using script-src 'self' without unsafe-inline.
Temporarily disable the organizations feature in affected realms if upgrade cannot be performed immediately.

bash

# Configuration example: validate organization alias via Admin REST API before creation
# Reject any alias not matching the safe identifier pattern
ALIAS="$1"
if ! [[ "$ALIAS" =~ ^[a-zA-Z0-9_-]{1,64}$ ]]; then
  echo "Rejected alias: contains disallowed characters"
  exit 1
fi

curl -X POST "https://keycloak.example.com/admin/realms/myrealm/organizations" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"alias\":\"$ALIAS\",\"name\":\"$ALIAS\"}"