Repository navigation
[CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler #48049
Description
Description
A stored cross-site scripting (XSS) issue exists in the organization selection login page (select-organization.ftl). When an organization alias contains malicious JavaScript code, FreeMarker's HTMLOutputFormat escapes the value for HTML attribute context, but this escaping is insufficient when the attribute is an inline JavaScript onclick handler.
The browser HTML-decodes entities before passing the value to the JavaScript engine, allowing the injected script to execute. This occurs because the template uses ${organization.alias} directly in an onclick attribute without JavaScript-specific escaping.
Prerequisites:
- User must have
manage-realmormanage-organizationspermission to create organizations with malicious aliases - Organizations feature must be enabled in the realm
Version Affected
26.5.5 and potentially other versions
Steps to Reproduce
- Log in as a user with
manage-realmormanage-organizationspermission - Create a new organization with an alias containing JavaScript code
- Navigate to the login page where organization selection is displayed
- Click on the organization entry
- Observe that the JavaScript code executes in the browser
Expected Behavior
Organization aliases should be properly escaped for JavaScript context when used in inline event handlers. The system should either:
- Use JavaScript-specific escaping for values in
onclickhandlers - Avoid inline event handlers entirely and use event listeners instead
- Validate organization aliases to prevent JavaScript-unsafe characters
Actual Behavior
The organization alias is only HTML-escaped, which is insufficient for inline JavaScript context. The browser decodes HTML entities before executing the JavaScript, allowing the injected code to run.
Additional Context
This issue has been assigned CVE-2026-37980 for tracking purposes.
While this requires elevated administrative permissions (manage-realm or manage-organizations), it could be problematic in scenarios where:
- Organization names are provisioned automatically via API/automation that assumes all characters are safe
- A compromised admin account could use this to escalate access to other realms
- Multiple administrators with different trust levels manage organizations
The team is planning a comprehensive review of FreeMarker templates to identify similar context-specific escaping issues.
This issue was originally tracked in the private repository. Migrated by @ahus1.
Activity
ahus1 commentedon Apr 14, 2026
@pedroigor the embargo has been lifted. Please provide a fix in upstream as discussed previously thanks!
Do not use inline handlers when rendering org buttons
Do not use inline handlers when rendering org buttons
2 remaining items
Do not use inline handlers when rendering org buttons
Do not use inline handlers when rendering org buttons
Do not use inline handlers when rendering org buttons