En resumen
- CVE-2026-37980 es una vulnerabilidad MEDIO (CVSS 4.8) que afecta a org.keycloak:keycloak-services.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.36%, mayor que el 29.3% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
Description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the organization.alias is placed into an inline JavaScript onclick handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
NVD description
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
Más vulnerabilidades de org.keycloak:keycloak-services
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free