Keycloak redirect URI validation bypass XSS

CVE-2026-9086 is a cross-site scripting vulnerability in Keycloak caused by improper validation of client redirect URIs. An attacker with administrative privileges, specifically a principal holding manage-client permission or access to client registration endpoints, can register a malicious client using a specially crafted redirect URI that leverages a case-insensitive javascript: or data: scheme to bypass URI validation. When a victim later follows a crafted link that uses the malicious client, including in flows such as logout or within the Admin Console, attacker-controlled script can execute in the Keycloak origin. The flaw is therefore an input validation weakness in redirect URI scheme handling that results in stored or persistent XSS conditions tied to malicious client registration.