CVE-2026-37980

[CVE catalog]

Severity

Medium · CVSS 6.9CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Published

Apr 6, 2026, 12:34:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 25, 2026

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm. org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page This vulnerability has Moderate impact. A Stored Cross-Site Scripting (XSS) flaw in the organization selection login page of Red Hat Build of Keycloak (RHBK) allows an attacker with `manage-realm` or `manage-organizations` privileges to inject a crafted JavaScript payload. This payload executes in the context of a user's browser when the login page is viewed, potentially leading to session theft or further attacks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.