EUVD-2026-53381
GHSA-6j7g-hr6v-3hxc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable URI manipulation requires only a valid low-privilege session; no availability impact described; scope unchanged as impact is bounded to Keycloak itself.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
AnalysisAI
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
Technical ContextAI
Keycloak Authorization Services exposes a PathMatcher component responsible for comparing incoming request URIs against configured security policy rules. The flaw arises because PathMatcher does not apply URI normalization before performing policy lookups - characters such as trailing slashes (e.g., '/admin/' vs '/admin') or matrix parameters (e.g., '/admin;jsessionid=xyz') cause the matcher to resolve a different, less restrictive policy than the intended one. This is a variant of path confusion or improper URI comparison, analogous to CWE-706 (Use of Incorrectly-Resolved Name or Reference) or CWE-863 (Incorrect Authorization), though no CWE is formally assigned in the advisory. Affected CPE strings confirm the issue spans cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack. The root cause is a normalization gap rather than a memory-safety or injection issue.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-15573 for patched package versions across Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack - no specific fixed version number was provided in the available intelligence data and inventing one would be misleading. As an immediate compensating control, restrict network access to Keycloak admin endpoints (typically /auth/admin and /admin) at the network or reverse-proxy layer using IP allowlisting, so that only trusted management hosts can reach those paths regardless of policy matching behavior. Additionally, audit Keycloak Authorization Services resource policies and ensure that wildcard or permissive path patterns are not inadvertently covering sensitive endpoints, reducing the blast radius of any policy mismatches. If self-registration is enabled and untrusted users can obtain accounts, consider temporarily disabling self-registration until the patch is applied, since any authenticated low-privilege account can leverage this flaw.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today