HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-9086 — A flaw was found in Keycloak. A remote attacker with administrative privileges, ...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-S

Analysis

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console. CVSS Score: 7.3. Published: 2026-06-25T17:17:03.147.

Indicators of Compromise (1)

CVE (1)
CVE-2026-9086
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Quantifind Raises $200 Million for AI-Native Risk Intelligence

Quantifind will accelerate international expansion and extend its platform’s localized risk intelligence capabilities. The post Quantifind Raises $200 Million for AI-Native Risk Intelligence appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerability

NVD CRITICAL: CVE-2026-12073 — The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is ...

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to ch

CVE-2026-12073
NIST NVD
LOWVulnerability

New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking

CISA has published an advisory to inform organizations about three vulnerabilities found by a researcher in Daktronics controllers. The post New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking appeared first on SecurityWeek .

SecurityWeek