AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

Red HatCVE-2026-107889

Red Hat login theme rendering: cross-site scripting

Red Hat

CVE-2026-107889 · Published Oct 9, 2026 · updated Nov 6, 2026

Medium5.5
No fix yet
Red Hat advisory

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.

Affected versions

PackageAffectedFixed in
Red Hat Single Sign-On 7
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.6.8
Product
all versionsNo fix yet
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More Red Hat advisories

All Red Hat
Medium 5.5Oct 9Red Hat Enterprise Linux: null pointer dereferenceCVE-2026-108093no fix yetMedium 6.3Oct 9Red Hat Enterprise Linux 6: privilege escalationCVE-2026-108119no fix yetMedium 5.5Oct 9Red Hat libhangul.: denial of serviceCVE-2026-108063no fix yetCritical 9.3Oct 9Red Hat gvproxy: path traversalCVE-2026-107935fixed in Red Hat +1Medium 4.0Oct 9Red Hat CUPS.: null pointer dereferenceCVE-2026-107655no fix yetMedium 5.5Oct 8Red Hat Enterprise Linux: heap buffer overflowCVE-2026-107651no fix yet