---
id: CVE-2026-37980
aliases:
  - GHSA-m32f-8vh9-2hh3
title: >-
  Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in
  organization selection login page
summary: >-
  Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in
  organization selection login page
severity: medium
cvss: 6.9
cwe:
  - CWE-79
vendor: keycloak
product: 'org.keycloak:keycloak-services'
ecosystem: maven
affected:
  - 'org.keycloak:keycloak-services <= 26.5.5'
published: '2026-04-14'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T21:33:03Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m32f-8vh9-2hh3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-37980'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-37980'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2455325'
  - url: 'https://github.com/keycloak/keycloak/issues/48049'
  - url: 'https://access.redhat.com/errata/RHSA-2026:19596'
  - url: 'https://github.com/advisories/GHSA-m32f-8vh9-2hh3'
tags:
  - ghsa
  - maven
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-04-14T15:42:46.799995Z'
epss: 0.00382
epssPercentile: 0.30952
ingestedAt: '2026-10-22T22:00:50.248Z'
---

## Overview

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.

## Affected packages

- `org.keycloak:keycloak-services <= 26.5.5`

## Remediation

Refer to the advisory for the patched release.