EUVD-2026-39471
GHSA-79qw-g39g-mfxc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryIdentify configured access-denied page path
-
ExploitCraft request URL embedding that path
-
ExecutionPolicy Enforcer skips authorization checks
-
ImpactAccess protected resources
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires (1) a valid authenticated account of any privilege level (CVSS PR:L - not anonymous), and (2) the target application must use the Keycloak Policy Enforcer adapter with an access-denied page path configured, since the bypass works by including that exact configured path in the request URL as a path segment or query parameter. No user interaction and no elevated privileges are needed. Limiting factors: deployments that do not use the Policy Enforcer, or that independently enforce authorization at the application layer, are not exploitable via this vector, and the attacker must know or guess the configured access-denied page path. There is no public exploit identified at time of analysis. |
| Impact | The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): network-reachable, low complexity, only a low-privilege authenticated account required, with high confidentiality and integrity impact and no availability impact. The decisive signal is that any valid, even minimally privileged user can fully defeat the authorization layer that Keycloak exists to provide - a serious risk for multi-tenant or least-privilege deployments. Mitigating factors: PR:L means an account is required (not anonymous internet exploitation), and exploitation is limited to deployments that actually use the Policy Enforcer adapter with an access-denied page configured. No EPSS score was provided in the input and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was referenced. Net: a genuine high-priority patching target where the Policy Enforcer is in use, but not an active-exploitation emergency based on available data. |
| Exploit ScenarioDerived | A low-privilege authenticated user of a Keycloak-protected application finds that requests to restricted resources are blocked by the Policy Enforcer. They re-issue the request with the configured access-denied page path appended as an extra path segment or added as a query parameter; the enforcer treats the request as exempt, skips all role/scope/UMA checks, and returns the protected data. No public POC is referenced, but the technique needs only a valid account and a crafted URL (AV:N/AC:L/PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access controls - role, scope, and User-Managed Access (UMA) permission checks - by embedding the configured access-denied page path inside a request URL as a path segment or query parameter. The affected component ships in the Red Hat Build of Keycloak, and successful exploitation grants unauthorized access to protected resources. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixed Red Hat Build of Keycloak release once published; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9800 and the tracking bug at https://bugzilla.redhat.com/show_bug.cgi?id=2482472 for the exact patched version, which is not stated in the available data (no vendor-released fix version was provided, so verify the target release directly with Red Hat before scheduling). As a compensating control until patched, do not rely solely on the Policy Enforcer's access-denied-path matching: enforce authorization at the protected application/API layer as well, and place a reverse proxy or WAF rule in front of protected endpoints that rejects requests whose path or query string contains the configured access-denied page path (side effect: legitimate links to the access-denied page itself may be blocked, so scope the rule tightly). Where feasible, change the configured access-denied page path to a hard-to-guess, non-overlapping value and audit access logs for requests containing that path string. These controls reduce exposure but do not replace the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak is a widely used open-source identity and access management (IAM) server; its Policy Enforcer is the adapter component that intercepts requests to protected applications and evaluates fine-grained authorization policies (role-based, scope-based, and UMA permissions) before granting access. The root cause maps to CWE-1025 (Comparison Using Wrong Factors): the enforcer matches incoming request paths against the configured access-denied page path to identify exempt/public routes, but performs this comparison too loosely - treating any URL that merely contains the access-denied path as exempt. An attacker thereby confuses policy evaluation by appending or injecting that path string, causing the enforcer to skip authorization entirely. Affected per CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak (version wildcarded).
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable with low complexity; a low-privilege authenticated account suffices (PR:L); full authorization bypass yields high confidentiality and integrity impact but no availability effect (A:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Blast Radius
ecosystem impact- 3 maven packages depend on org.keycloak:keycloak-policy-enforcer (2 direct, 1 indirect)
- 52 maven packages depend on org.keycloak:keycloak-services (20 direct, 32 indirect)
Ecosystem-wide dependent count for version 26.0.10 and other introduced versions.
Executive ViewAI
Red Hat Build of Keycloak contains an authorization bypass vulnerability (CVSS 8.1) in the Policy Enforcer that allows authenticated users to circumvent all access controls including roles, scopes, and permissions by manipulating request URLs. This directly threatens the access control posture of organizations relying on Keycloak, enabling authenticated insiders to reach protected resources beyond their assigned permissions.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Keycloak authentication to least-privilege user sets; (2) Implement network segmentation between Keycloak and protected backend services; (3) Add secondary authorization layer in application logic independent of Policy Enforcer; (4) Enable real-time alerting on suspicious URL pattern access attempts; (5) Consider temporarily disabling Policy Enforcer and deploying alternative access control for critical systems pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Exploit-DB