External risk intelligence

Keycloak Client Management JavaScript Policy Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-120984

Keycloak is often deployed as an identity provider accessible via the network. However, this vulnerability requires an authenticated attacker with specific client management permissions to perform the action. Since this is an administrative or privileged function rather than a default public-facing endpoint, public exposure of the vulnerable administrative path is less common than general web traffic.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in Keycloak's client management, potentially allowing authenticated attackers to execute malicious code on the server. This issue arises from an incomplete session attribute clearing during client setup, which, when exploited, could lead to a full system compromise.

Flaw lets attackers run code on the server.
Matters if you manage client access.
Confirm if Keycloak's client management is used.

Attack Path

How an attacker could exploit the issue

An attacker with client management permissions can exploit a flaw in Keycloak's client setup process to introduce a malicious JavaScript policy. This policy, once uploaded, can be triggered during authorization requests, leading to the execution of arbitrary code on the server.

Authenticated attacker with client management.
Malicious policy uploaded during client setup.
Arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

When an authenticated attacker with client management permissions can create or import clients with authorization services enabled, a flaw in session attribute handling could allow them to bypass security controls. This could lead to the execution of malicious JavaScript on the server during authorization requests, potentially enabling arbitrary code execution.

System data and service behavior could be affected.
Malicious JavaScript could be uploaded and executed.
Arbitrary code execution on the server is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability in Keycloak's client management component requires immediate attention from teams responsible for identity and access management infrastructure. The first practical step is to identify all Keycloak instances, assess their exposure and criticality, and then locate the accountable system owners before planning remediation.

Identity and Access Management teams own the issue.
Verify Keycloak instance exposure and criticality first.
Plan remediation based on identified system owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Keycloak and how is it used?

Keycloak is an open-source identity and access management server. It is used by organizations to secure applications and services by providing centralized authentication, single sign-on (SSO), and fine-grained authorization features, allowing developers to manage user identities rather than building these functions into every application.

What does CWE-94 mean for CVE-2026-120984?

CWE-94 refers to the improper control of generation of code, often called Code Injection. In this vulnerability, the system fails to clear a session attribute during client setup. This flaw allows a privileged user to insert and execute unauthorized JavaScript, essentially tricking the server into running code that was never intended to be part of the application's legitimate logic.

How is this vulnerability triggered?

An attacker must already have high-level permissions to manage clients within the system. Simply browsing to the site does not trigger it; the issue specifically occurs when a client is created or imported with authorization services enabled. If these specific administrative actions are not performed, the flaw cannot be exploited via this path.

Is my Keycloak instance at risk?

Halo Surface Signal notes that while Keycloak is often network-accessible, this vulnerability requires specific administrative privileges to trigger. Since it relies on client management functions rather than standard user-facing endpoints, instances that restrict access to administrative panels are at lower risk than those with broadly exposed management interfaces.

What should I do first to address this?

Begin by inventorying your Keycloak instances to understand which systems are running and who owns them. Focus on identifying environments where client management capabilities are active. Once you have a clear picture of your infrastructure, consult with your identity management team to verify the specific versions in use and coordinate a path toward remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.