CVE-2026-9086: Keycloak Redirect URI Validation Bypass in Service Virtualization (DevTest)

Products

• Service Virtualization

Issue/Introduction

A security vulnerability (CVE-2026-9086) has been identified in the Keycloak component used by the Identity and Access Management (IAM) of Service Virtualization (DevTest).

A flaw in Keycloak allows a remote attacker with administrative privileges (specifically those with manage-client permissions or access to client registration endpoints) to bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme.

This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks a crafted link, such as during the logout flow or within the Admin Console.

Vulnerability Details

• CVE-ID: CVE-2026-9086
• CVSS Score: 7.3 (High)
• Impact: Cross-Site Scripting (XSS) and arbitrary code execution.

Environment

Product: Service Virtualization (DevTest) 

Component: Identity and Access Management (IAM) / Keycloak

Cause

The vulnerability stems from improper validation of the redirect URI schemes within Keycloak's client registration logic, which fails to block potentially malicious URI schemes.

Resolution

Broadcom Engineering has addressed this vulnerability in the integrated Keycloak libraries. The fix is included in the following release:

• Service Virtualization (DevTest) 10.9.2

Remediation Steps

1. Plan Upgrade: Schedule an upgrade of your DevTest environment to version 10.9.2 or later once available.
2. Immediate Mitigation (Best Practice):
   • Review administrative permissions and restrict the manage-client permission to trusted users only.
   • Audit configured "Valid Redirect URIs" for all clients in the Keycloak Admin Console.
   • Replace wildcard (*) configurations with specific, authorized URIs to reduce the attack surface.