CVE-2026-37980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-37980", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-04-06T07:48:39.722Z", "datePublished": "2026-04-14T14:54:42.871Z", "dateUpdated": "2026-10-22T20:38:08.354Z"}, "containers": {"cna": {"title": "Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbk/keycloak-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "name": "RHSA-2026:19596", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-37980", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455325", "name": "RHBZ#2455325", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-04-06T12:34:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "workarounds": [{"lang": "en", "value": "Restrict access to the Keycloak administration console and login pages to trusted networks only, ideally through a VPN or by configuring firewall rules. Furthermore, ensure that only highly trusted administrators are granted `manage-realm` or `manage-organizations` privileges within Keycloak. Regularly review and audit administrative accounts and their assigned roles to minimize the risk of unauthorized access and exploitation. If the Keycloak service is restarted or reloaded, these network and access restrictions will persist."}], "timeline": [{"lang": "en", "time": "2026-04-06T07:51:18.531Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-06T12:34:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-22T20:38:08.354Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:42:46.799995Z", "id": "CVE-2026-37980", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:43:02.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-37980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:42:46.799995Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:42:53.829Z"}}], "cna": {"title": "Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-06T07:51:18.531Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-06T12:34:00.000Z", "value": "Made public."}], "datePublic": "2026-04-06T12:34:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "name": "RHSA-2026:19596", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-37980", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455325", "name": "RHBZ#2455325", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict access to the Keycloak administration console and login pages to trusted networks only, ideally through a VPN or by configuring firewall rules. Furthermore, ensure that only highly trusted administrators are granted `manage-realm` or `manage-organizations` privileges within Keycloak. Regularly review and audit administrative accounts and their assigned roles to minimize the risk of unauthorized access and exploitation. If the Keycloak service is restarted or reloaded, these network and access restrictions will persist."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-22T20:38:08.354Z"}, "x_redhatCweChain": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}}, "cveMetadata": {"cveId": "CVE-2026-37980", "state": "PUBLISHED", "dateUpdated": "2026-10-22T20:38:08.354Z", "dateReserved": "2026-04-06T07:48:39.722Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-04-14T14:54:42.871Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "defaultStatus": "unaffected", "product": "Red Hat build of Keycloak 26.4.12", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*", "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Keycloak, espec\u00edficamente en la p\u00e1gina de inicio de sesi\u00f3n de selecci\u00f3n de organizaci\u00f3n. Un atacante remoto con privilegios administrativos \u2019manage-realm\u2019 o \u2019manage-organizations\u2019 puede explotar una vulnerabilidad de Cross-Site Scripting (XSS) almacenado. Este fallo ocurre porque el \u2019organization.alias\u2019 se inserta en un gestor \u2019onclick\u2019 de JavaScript en l\u00ednea, permitiendo que una carga \u00fatil de JavaScript manipulada se ejecute en el navegador de un usuario cuando visualizan la p\u00e1gina de inicio de sesi\u00f3n. La explotaci\u00f3n exitosa permite la ejecuci\u00f3n arbitraria de JavaScript, lo que podr\u00eda llevar al robo de sesi\u00f3n, acciones de cuenta no autorizadas o ataques adicionales contra usuarios del reino afectado."}], "id": "CVE-2026-37980", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.7, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-37980", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T15:42:46.799995Z", "version": "2.0.3"}}]}, "published": "2026-04-14T15:16:34.230", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:19596"}, {"source": "secalert@redhat.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2026-37980"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455325"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page", "id": "2455325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455325"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm."], "mitigation": {"lang": "en:us", "value": "Restrict access to the Keycloak administration console and login pages to trusted networks only, ideally through a VPN or by configuring firewall rules. Furthermore, ensure that only highly trusted administrators are granted `manage-realm` or `manage-organizations` privileges within Keycloak. Regularly review and audit administrative accounts and their assigned roles to minimize the risk of unauthorized access and exploitation. If the Keycloak service is restarted or reloaded, these network and access restrictions will persist."}, "name": "CVE-2026-37980", "package_state": [{"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}], "public_date": "2026-04-06T12:34:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-37980\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-37980"], "statement": "This vulnerability has Moderate impact. A Stored Cross-Site Scripting (XSS) flaw in the organization selection login page of Red Hat Build of Keycloak (RHBK) allows an attacker with `manage-realm` or `manage-organizations` privileges to inject a crafted JavaScript payload. This payload executes in the context of a user's browser when the login page is viewed, potentially leading to session theft or further attacks.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 98.0, "source": "matching"}]}, "original": {"product": "Red Hat Build of Keycloak", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_keycloak", "vendor": "redhat"}], "analysis": {"en": {"generated_at": "2026-04-14T16:35:36.926606+00:00", "value": {"mitigation_remediation": ["Apply the latest Red Hat build of Keycloak that contains the CVE-2026-37980 fix.", "Restrict access to the Keycloak administration console and login pages to trusted networks only, ideally through a VPN or firewall rules.", "Ensure that only highly trusted administrators are granted manage-realm or manage-organizations privileges within Keycloak.", "Regularly review and audit administrative accounts and their assigned roles to minimize risk."], "summary": {"action": "Restrict Access", "impact": "Arbitrary Code Execution via Stored XSS"}, "threat_synthesis": {"affected_systems": "Red Hat Build of Keycloak is affected. No specific version information is provided in the advisory.", "description_and_impact": "A flaw was found in Keycloak\u2019s organization selection login page. An attacker who has manage-realm or manage-organizations privileges can inject a crafted JavaScript payload because the organization.alias value is inserted directly into an inline onclick handler. When a user visits the login page the payload runs in their browser, allowing arbitrary script execution and enabling session theft, unauthorized account actions, or further attacks against users of the affected realm.", "risk_and_exploitability": "The CVSS base score is 6.9, indicating a moderate risk. Exploitation requires the attacker to possess privileged administrative permissions and to create a malicious organization alias. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting the public exploit landscape is currently limited. Nevertheless, because arbitrary JavaScript can be executed in logged\u2011in users, the potential impact on confidentiality, integrity, and availability is significant for systems that rely on Keycloak for authentication."}}}}, "created": "2026-04-14T16:37:16.146965+00:00", "updated": "2026-04-15T14:41:09.665527+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_keycloak"]}