A newly tracked flaw, CVE-2026-107889, hits Keycloak's login theme rendering: the filter meant to sanitize user-supplied text can be sidestepped, letting a realm administrator plant malicious scripts in fields shown on the login page. Any visitor who loads that page then risks running the injected JavaScript in their browser, which could expose session data or otherwise interfere with their login. Because the attacker here already needs admin-level access to a realm, the bug is a stored XSS escalation rather than a fully unauthenticated takeover.
// source: nvd.nist.gov ↗