A flaw in the login theme rendering component of Keycloak allows a realm administrator to bypass the security filter and store malicious scripts in display fields. The resulting stored cross‑site scripting can execute arbitrary JavaScript whenever users visit the login page, thereby risking data exposure or session interference. The weakness is a classic Input Validation flaw (CWE‑79).

The affected products include Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific affected version numbers are listed in the CNA data; the issue applies to the versions of these products that contain the vulnerable login theme logic.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is currently no evidence of active exploitation in the wild. The likely attack vector involves an upstream realm administrator injecting malicious code through the administrative theme editor, which is then rendered on the public login page and executed in visitors’ browsers.