---
id: CVE-2026-120984
title: >-
  Keycloak-services: keycloak-services: manage-clients to arbitrary code
  execution through inline javascript policy import
summary: >-
  A flaw was found in the Keycloak server's client management component. When a
  client is created or imported with authorization services enabled, the system
  fails to properly clear an internal session attribute used during the setup
  proce…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - keycloak-services (all versions)
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T13:22:00.998Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120984'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-120984'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2565599'
    label: RHBZ#2565599
tags:
  - cve.org
ingestedAt: '2026-11-07T14:18:21.473Z'
---

## Overview

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.

## Affected

- `keycloak-services (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `keycloak-services (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.