A flaw was found in Keycloak’s organization selection login page. An attacker who has manage-realm or manage-organizations privileges can inject a crafted JavaScript payload because the organization.alias value is inserted directly into an inline onclick handler. When a user visits the login page the payload runs in their browser, allowing arbitrary script execution and enabling session theft, unauthorized account actions, or further attacks against users of the affected realm.

Red Hat Build of Keycloak is affected. No specific version information is provided in the advisory.

The CVSS base score is 6.9, indicating a moderate risk. Exploitation requires the attacker to possess privileged administrative permissions and to create a malicious organization alias. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, suggesting the public exploit landscape is currently limited. Nevertheless, because arbitrary JavaScript can be executed in logged‑in users, the potential impact on confidentiality, integrity, and availability is significant for systems that rely on Keycloak for authentication.