CVE-2026-107889

A stored Cross-Site Scripting (XSS) vulnerability exists in the login theme rendering component of Keycloak . The flaw arises because the security filter intended to sanitize user input can be bypassed, enabling a realm administrator to inject malicious scripts into display fields. If exploited, ...

CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...

CVE-2026-107889 Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...