GHSA-37j9-56gh-j2r7

Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Published

2026-06-25

Modified

2026-10-29

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v3f7-2p4r-mwfw. This link is maintained to preserve external references. ### Original Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-37j9-56gh-j2r7