Red Hat

CVE-2026-120984: A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fail

CVE-2026-120984 Nov 7, 2026 Source: Vendor

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-120984

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-120984 BR2026-0000-043328 unclaimed

Credited as Red Hat would like to thank Nassim Abbaoui (OVHcloud) and Marcin Naskręt (UNSHADE) for reporting this issue