CVE-2026-107889

5.5 Moyenne

Publiée le 09/10/2026 à 07:16 · Modifiée le 13/10/2026 à 19:17 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.

Traduire en français

Produits concernés

Red Hat Build of Keycloak
Red Hat Single Sign-On 7

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.5 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://access.redhat.com/security/cve/CVE-2026-107889
https://bugzilla.redhat.com/show_bug.cgi?id=2548355

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories