AIKIDO-2026-309693

TL;DR

Keycloak validates client redirect URIs case-sensitively, so a crafted javascript: or data: scheme using mixed case slips past the scheme blocklist. A user who can register or manage clients can store a malicious redirect URI that executes script in the Keycloak origin. The payload fires when a victim follows the crafted link, such as during logout or in the Admin Console, enabling cross-site scripting. The fix makes URI scheme validation case-insensitive.