Keycloak CVE-2026-74909

Exploitation requires that the target application be deployed behind the Keycloak/Red Hat SSO policy enforcer with defined path-based security policies - the flaw is in the enforcer's URL normalization of encoded characters (encoded semicolons and directory-traversal segments), so an application not using the policy enforcer is unaffected. The attacker must be an authenticated user with a valid (even low-privilege) account (PR:L), reachable over the network (AV:N) with no user interaction. The limiting factors are: valid credentials are mandatory (not a pre-auth flaw), and the deployment must rely on the policy enforcer's path matching for authorization rather than in-application checks; environments enforcing authorization inside the application itself are not exposed via this path.

This is a genuine, above-average priority for organizations running Keycloak/Red Hat SSO as an authorization gateway, though not an emergency. The CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is well-constructed and defensible: it requires an already-authenticated low-privilege user (PR:L), no user interaction, low complexity, and yields high confidentiality and integrity impact by exposing protected admin/private endpoints. No EPSS score, no CISA KEV listing, and no public exploit code were supplied in the intelligence, so exploitation is presently theoretical rather than observed - the score is driven by impact and ease, not by evidence of in-the-wild activity. The signals are internally consistent (no contradiction between network vector and description, which does describe HTTP request manipulation), and the CWE-862 (Missing Authorization) mapping fits an authorization-bypass-via-normalization flaw better than a pure path-traversal class. The key tempering factor absent from the raw score is that this only matters where the Keycloak policy enforcer is actually deployed in front of an application, so the effective exposure is narrower than the vendor product's overall install base.

An attacker who already holds a valid low-privilege account on an application protected by the Keycloak policy enforcer crafts a request URL containing encoded special characters (e.g., encoded semicolons or directory-traversal segments) that the enforcer normalizes incorrectly. The enforcer matches the malformed path against a less restrictive policy and forwards the request, granting the user access to administrative or private endpoints they should not reach. No public proof-of-concept was identified in the provided data.