Keycloak Cross-Site Scripting Vulnerability CVSS 6.9 (Medium)

CERT-Bund published a security advisory on 14 April 2026 regarding a Cross-Site Scripting vulnerability in Keycloak, an open-source Single Sign-On and Identity and Access Management solution. The vulnerability affects Linux and UNIX environments and carries a CVSS Base Score of 6.9 (Medium) with a Temporal Score of 6.3. The vulnerability allows a remote, authenticated attacker to conduct XSS attacks.

Organizations running Keycloak on Linux or UNIX systems should prioritize assessment of their deployments, monitor for available patches from Keycloak maintainers, and implement temporary workarounds such as input sanitization or network-level restrictions until patches are available. Security teams should include Keycloak instances in vulnerability management scanning and ensure incident response procedures account for potential XSS exploitation scenarios.