[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2026-9086":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":20,"cwes":21,"cpes":23,"technologies":25,"references":27,"score":35,"epss_score":36,"epss_percentile":37,"is_kev":38,"cisa_kev_date_added":39,"cisa_kev_due_date":39,"cisa_ssvc":40,"attack_mappings":50,"exploits":57},360545,"CVE-2026-9086","EUVD-2026-39473","A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.","2026-06-25T17:17:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":15,"userInteraction":17,"attackComplexity":18,"availabilityImpact":19,"privilegesRequired":18,"confidentialityImpact":15},"UNCHANGED","3.1",7.3,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N","REQUIRED","LOW","NONE",true,[22],"CWE-79",[24],"cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",[26],"Redhat Build Of Keycloak",[28,29,30,31,32,33,34],"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30083","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30084","https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-9086","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2480170","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30049","https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30050","https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-9086.json",0.56,0.00781,0.55678,false,null,{"timestamp":41,"automatable":42,"tech_impact":43,"exploitation":44,"cisa_decision":45,"cisa_remediation_timeline":49},"2026-06-25T17:59:48.293762Z","no","total","none",{"vector":46,"decision":47,"priority":48},"CISAv1\u002FE:N\u002FA:N\u002FT:T\u002FM:H\u002F2026-10-25T16:04:26.812717\u002F","track_star","medium","14D",[51],{"name":52,"source":53,"tactics":54,"technique_id":56},"Exploit Public-Facing Application","attack_vector",[55],"initial-access","T1190",[]]