CVE-2026-37980

Katalog CVE

CVSS 4.8 · Medium EPSS 0,38%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada redhat build of keycloak. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

Rincian

Terbit di NVD

14 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-37980 mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2455325 issue tracking · advisory vendor