A flaw in Keycloak's client management component causes an internal session attribute to remain uncleared during the import of clients with authorization services enabled. An authenticated user with client‑management permissions can bypass security controls to upload a malicious JavaScript policy, which the server then executes when an authorization request is processed. Successful exploitation permits arbitrary code execution, potentially compromising the entire server.

The vulnerability affects Red Hat’s Build of Keycloak and Red Hat Single Sign‑On 7. Specific vulnerable versions are not enumerated in the available data, so any release built from these vendor products is potentially impacted until a patch is applied.

The vulnerability has a CVSS score of 9.1, indicating critical severity, but its EPSS score is not available and it is not listed in CISA KEV. The attack requires the attacker to be authenticated and have client‑management privileges, allowing them to create or import a client. The limited prerequisites reduce the attack surface, but the impact remains severe if the conditions are met. The exploitation path involves adding a malicious JavaScript policy that the server executes during normal authorization handling.