← CVE Intelligence

CVE-2026-9800

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison PUBLISHED

Description (CNA)

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.13-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-19 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4.14-1 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-22 before *
Red Hat / Red Hat build of Keycloak 26.4unaffected 26.4-22 before *
Red Hat / Red Hat build of Keycloak 26.4.13unaffected
Red Hat / Red Hat build of Keycloak 26.4.14unaffected
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6.4-2 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6unaffected 26.6-8 before *
Red Hat / Red Hat build of Keycloak 26.6.4unaffected
Red Hat / Red Hat build of Quarkus 3.27.4.SP2unaffected 26.0.10.redhat-00001 before *
Red Hat / Red Hat build of Quarkus 3.33.2.SP2unaffected 26.0.10.redhat-00001 before *
Red Hat / Red Hat build of Quarkusunknown
Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packunaffected
Red Hat / Red Hat Single Sign-On 7unknown

CWE

CWE-1025

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.