CVE-2026-107889

Published: Oct 9, 2026Modified: Oct 13, 2026

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://access.redhat.com/security/cve/CVE-2026-107889

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2548355

Source: secalert@redhat.com

Timeline

No history available yet.