{"id":"CVE-2026-37980","aliases":["GHSA-m32f-8vh9-2hh3"],"title":"Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page","summary":"Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page","severity":"medium","cvss":6.9,"cwe":["CWE-79"],"vendor":"keycloak","product":"org.keycloak:keycloak-services","ecosystem":"maven","affected":["org.keycloak:keycloak-services <= 26.5.5"],"published":"2026-04-14","updated":"2026-10-22","sourceUpdated":"2026-10-22T21:33:03Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m32f-8vh9-2hh3","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37980"},{"url":"https://access.redhat.com/security/cve/CVE-2026-37980"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455325"},{"url":"https://github.com/keycloak/keycloak/issues/48049"},{"url":"https://access.redhat.com/errata/RHSA-2026:19596"},{"url":"https://github.com/advisories/GHSA-m32f-8vh9-2hh3"}],"tags":["ghsa","maven","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-04-14T15:42:46.799995Z"},"epss":0.00382,"epssPercentile":0.30952,"ingestedAt":"2026-10-22T22:00:50.248Z","slug":"CVE-2026-37980","body":"## Overview\n\nA flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.\n\n## Affected packages\n\n- `org.keycloak:keycloak-services <= 26.5.5`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}