CVE-2026-120984 is a critical (CVSS 9.1) flaw in Keycloak's client management component that lets an authenticated attacker with client management permissions upload a malicious JavaScript policy, which the server then runs.
What Is It
The flaw is in the client management component of the Keycloak server. When someone creates or imports a client with authorization services enabled, Keycloak does not properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can use this to get around security controls and upload a malicious JavaScript authorization policy. The server runs that policy the next time an authorization request is made.
NVD classifies the weakness as CWE-94 (Improper Control of Generation of Code, or "Code Injection"). Red Hat ([email protected]) submitted the record, which was published on 2026-11-07 and is still marked "Awaiting Analysis."
Why It Matters
According to the description, successful exploitation could let the attacker run arbitrary code on the server and possibly compromise the whole system. Red Hat scores it 9.1 CRITICAL with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H:
- Attack vector is network, with low attack complexity and no user interaction
- High privileges are required, meaning an account with client management permissions
- Scope is changed, so the impact reaches beyond the vulnerable component
- Confidentiality, integrity and availability impacts are all high
The high-privilege requirement limits who can exploit it. Still, Keycloak is a central identity provider, so code running on that server puts every application that relies on it at risk.
Exploitation status: No CISA KEV entry was provided for this CVE, so the supplied data does not confirm active exploitation.
What's Vulnerable
The NVD record lists these Red Hat products as affected:
- Red Hat Build of Keycloak: package
keycloak-services - Red Hat Build of Keycloak: package
rhbk/keycloak-rhel9 - Red Hat Single Sign-On 7: package
keycloak-services
The supplied record does not name specific affected version ranges.
Patch Status
The supplied NVD data does not include a fixed version, patch release or vendor workaround. Because there is no KEV entry, there is no CISA-mandated required action or due date. Organizations running affected Red Hat Build of Keycloak or Red Hat Single Sign-On 7 deployments should:
- Check the Red Hat CVE page and Bugzilla entry below for fix and errata status.
- Review which accounts hold client management permissions, since exploitation requires them.