CVE-2026-107889

Executive Summary

CVE-2026-107889 is a stored cross-site scripting (XSS) flaw in the login theme rendering component of Keycloak, in which the security filter intended to sanitize user-supplied input can be bypassed. A realm administrator can therefore persist malicious script content into display fields that are later rendered to any user visiting the affected login page. Successful exploitation results in arbitrary JavaScript execution in the victim's browser context, with potential for data exposure or session interference; no public proof-of-concept, exploit code, or vendor patch has been identified at the time of writing.

Technical Analysis

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) and resides within the login theme rendering component of Keycloak. The NVD description states that the security filter "responsible for cleaning user input can be bypassed," allowing a realm administrator to "store malicious scripts in display fields." Two properties of this description drive the analysis:

1. The flaw is a filter-bypass, not an absence of filtering. The component implements an input-sanitization filter, but that filter is not exhaustive — some payload construction evades it. This is characteristic of deny-list-based or pattern-based sanitizers that fail to account for alternative encodings, alternate HTML/JS syntaxes, or parser differentials between the sanitizer and the browser. Because the description does not enumerate the specific sanitization routine, encoding technique, or field identifiers involved, those implementation specifics cannot be stated and should not be assumed.

2. The injection is stored and rendered server-side via theming. "Display fields" within a login theme are rendered to every user who loads the login page. By storing the malicious script through an administrative configuration surface, the attacker converts a single privileged write into script execution across all visitors of that realm's login page — a classic stored-XSS pattern.

The attack surface is the administrative interface used to configure login theme display content (theme customization), and the delivery surface is the public-facing login page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N (base 5.5, Medium) reflects the following: network-reachable (AV:N), no special attack conditions (AC:L), but requiring High privileges (PR:H — the realm administrator), no user interaction required for the attacker's action of storing the payload (UI:N), Changed scope (S:C), and limited confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). The scope change is significant: the vulnerable component (administrative theming backend) impacts resources beyond its security scope (the browsers of ordinary login-page visitors), which is precisely the cross-user boundary that makes stored XSS impactful.

It is important to note the privilege context: exploitation requires realm-administrator rights. This is not an unauthenticated, internet-facing RCE-style bug; it is a privilege-escalation-adjacent, cross-user scripting issue in which a party already trusted with realm configuration can compromise the browsers of lower-privileged users. This constrains the threat model considerably, which is why no CISA KEV listing exists and the severity is Medium. No affected version range, fixed version, or vendor advisory has been published in the data provided, so the exact deployment footprint cannot be enumerated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored XSS via sanitizer bypass) and the facts stated in the NVD description. No specific function names, endpoints, parameters, or code patterns are asserted, because none are provided.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment and determines that they hold (or can obtain) realm-administrator access to a target realm. Because exploitation requires the PR:H privilege level, the operative precondition is administrative control over realm theming. Basic external reconnaissance consists of locating the Keycloak login page and confirming it is reachable.

2. Triggering the flaw class. Using the realm-administration interface for login theme configuration, the attacker writes crafted content into a display field that the login theme renders to visitors. The crafted content is constructed specifically to evade the security filter that is supposed to sanitize such input. The precise bypass technique is not disclosed in the available data; at the vulnerability-class level, filter bypasses of this nature typically involve encodings or syntax variants that the sanitizer does not recognize but the browser does. This report does not assert a specific technique.

3. Payload / execution method. Because the injected value is persisted and later rendered into the login page HTML, the stored content is executed as script in the browser of any user who loads that login page — no further attacker action is required at execution time (consistent with UI:N for the storage step). The execution occurs in the security context of the Keycloak login origin.

4. Post-exploitation impact. Script execution in the login-page origin enables the attacker to read or manipulate page content and interact with the user's session context on that page, consistent with the described "data exposure or session interference." Confidentiality and integrity impact are bounded (C:L/I:L); there is no availability impact per the vector. The realistic outcomes — credential-harvesting overlays, exfiltration of data visible on the login page, or interference with the login flow — are consistent with the description, though the report does not claim capabilities beyond what is stated.

Impact Assessment

The blast radius is defined by who visits the affected realm's login page. Because the injected content is stored in theme display fields and rendered to all visitors, the potential victim set is every user who authenticates against that realm — potentially the full user population of the realm, depending on how widely the poisoned login page is served. The CVSS scope subscore (S:C) captures that the impact crosses from the administrative/backend component into end-user browsers.

Business impact considerations:

• Confidentiality (C:L): Limited — potential exposure of data visible on or accessible from the login page, including through the logged-in user's browser session on that origin.
• Integrity (I:L): Limited — potential modification of content presented to the user and interference with the login flow.
• Availability (A:N): None per the vector.
• Privilege requirement (PR:H): The attacker must already be a realm administrator. This bounds who can mount the attack but sharpens the insider-risk and post-compromise-persistence angles: a compromised or malicious admin account yields a durable mechanism for reaching many users.
• User interaction (UI:N): No interaction is required for the payload to be stored and served; victims merely need to load the login page.

Overall, this is a Medium-severity (5.5) issue. It is not wormable and requires privileged access, but it provides cross-user script execution on a security-critical authentication surface — a meaningful risk for organizations where realm-administration duties are delegated to multiple parties or where admin accounts are a target for credential theft. No affected-version data or adoptions/exploitation evidence (KEV) is available to refine the footprint.

Detection Guidance

The following rules are heuristic starting points. Because no exploitation specifics (payload strings, encoding techniques, affected fields) are published, these detections target generic stored-XSS indicators on Keycloak login pages and should be tuned to the environment. False positives are expected and thresholds should be adjusted.

Sigma Rule

title: Potential Keycloak Login Theme Stored XSS Filter Bypass Attempt
id: 6f2c9b7e-1a44-4d8e-9c21-0b7f3e5d8a10
status: experimental
description: Detects administrative modification of Keycloak login theme / display content that may indicate stored XSS payload injection (CVE-2026-107889).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107889
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: admin
detection:
  selection_path:
    request_uri|contains:
      - '/admin/realms/'
  selection_theme:
    request_uri|contains:
      - 'theme'
      - 'login'
      - 'display'
  selection_payload:
    request_body|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '&#'
      - '%3Cscript'
  condition: selection_path and selection_theme and selection_payload
falsepositives:
  - Legitimate theme customization containing sanitized markup
level: medium
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_107889_Keycloak_Stored_XSS
{
    meta:
        description = "Detects potential stored XSS payload fragments in Keycloak login theme files (CVE-2026-107889)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107889"
        date = "2026-01-01"
        cwe = "CWE-79"

    strings:
        $s1 = "<script" nocase ascii wide
        $s2 = "javascript:" nocase ascii wide
        $s3 = "onerror=" nocase ascii wide
        $s4 = "onload=" nocase ascii wide
        $s5 = "onmouseover=" nocase ascii wide
        $s6 = "document.cookie" nocase ascii wide
        $s7 = "&#x" nocase ascii wide

    condition:
        (uint16(0) == 0x4B50 or filename matches /\\.(ftl|html|properties)$/i) and
        (2 of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107889 Keycloak Login Theme Stored XSS Payload in Admin Request"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/realms/"; http.uri; content:"theme"; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; sid:2026107889; rev:1; reference:cve,2026-107889; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name
  [http where http.request.method == "POST"
     and url.path : "/admin/realms/*"
     and url.path : "*theme*"]
  [http where http.request.method == "POST"
     and url.path : "/admin/realms/*"
     and http.request.body.text : ("*<script*" or "*onerror=*" or "*javascript:*")]

Splunk SPL Query

index=web OR index=proxy
(uri_path="*/admin/realms/*" AND uri_path="*theme*")
| eval body_lower = lower(coalesce(request_body, body, ""))
| where match(body_lower, "<script") OR match(body_lower, "onerror=")
    OR match(body_lower, "javascript:") OR match(body_lower, "%3cscript")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(uri_path) as paths by src_ip, user, http_user_agent
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,keycloak,xss,">
  <rule id="107889" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/admin/realms/</field>
    <match>theme</match>
    <field name="url">/admin/realms/</field>
    <regex type="pcre2">(?i)&lt;script|onerror=|javascript:|%3Cscript</regex>
    <description>CVE-2026-107889: Possible Keycloak login theme stored XSS payload injection via admin request</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_107889,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch, fixed version, vendor advisory, or workaround has been identified in any tracked source. The following guidance is therefore precautionary and not a substitute for an authoritative vendor fix once one is published.

1) Immediate mitigations

• Restrict realm-administration access. Because exploitation requires realm-administrator privileges (PR:H), tighten and audit who can manage realms and login theming. Enforce least privilege, MFA, and strong credential hygiene on all admin accounts.
• Harden login theme content. Inventory all realms' login-theme display fields and remove any non-essential dynamic or user-supplied content. Where possible, avoid delegating theme customization to untrusted administrators.
• Apply defense-in-depth at the edge. Deploy the detection rules above and consider a web application firewall / content-security policy that mitigates script execution on the login origin. A restrictive Content-Security-Policy on the login page can reduce the impact of injected inline scripts, though CSP tuning may be constrained by required theme functionality.
• Monitor and review administrative changes to realms and themes as a high-signal event class.

2) Patch / upgrade steps

• No fixed version is currently published. Monitor the Keycloak project's official security advisories and release channels and upgrade to the first version that resolves this issue as soon as it is available. Until then, treat all versions as potentially affected.
• Track the CVE record (NVD) for updates to affected/fixed version fields.

3) Long-term hardening

• Move login-page rendering toward output-encoding at render time rather than relying solely on input sanitization filters, which are prone to bypasses of this exact class (CWE-79).
• Adopt a strict Content-Security-Policy for authentication pages as a standing control that limits the blast radius of any future XSS.
• Implement continuous monitoring of administrative configuration changes and alert on suspicious theme/display-field edits.
• Include stored-XSS sanitizer-bypass scenarios in regular security testing of authentication surfaces.

References

• NVD — CVE-2026-107889: https://nvd.nist.gov/vuln/detail/CVE-2026-107889
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• Keycloak project — official security advisories and releases: https://www.keycloak.org/ (monitor for a vendor advisory addressing CVE-2026-107889)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-107889 is NOT listed as of this writing; no exploit-in-the-wild or threat-actor campaign evidence is currently available.