CVE-2026-120984: Keycloak lets client admins run code on server
The client management feature in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 does not fully clear a temporary session value when a client is created or imported with authorization services turned on. Because of this, a user who already has permission to manage clients can upload a malicious JavaScript policy that will be executed whenever an authorization request occurs, allowing the attacker to run any code on the server. To protect your environment, restrict client‑management rights to trusted users, apply the latest patches from Red Hat, and monitor for unexpected policy uploads or authorization requests.
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat build of keycloak | All versions |
| red hat | red hat single sign-on 7 | All versions |
- https://access.redhat.com/security/cve/CVE-2026-120984 vdb-entry x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2565599 issue-tracking x_refsource_REDHAT
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)