What is the CVSS score of EUVD-2026-32212?

EUVD-2026-32212 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Keycloak EUVD-2026-32212

| CVE-2026-9689 MEDIUM

Improper Validation of Consistency within Input (CWE-1288)

2026-05-27 secalert@redhat.com

GHSA-wcvj-vpvw-9rr5

Authentication Bypass Build Of Keycloak

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:26 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.0.

DescriptionCVE.org

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

AnalysisAI

HTTP parameter pollution in Keycloak enables authentication bypass against deployments where OAuth/OIDC client applications are configured with permissive redirect URI patterns. An unauthenticated remote attacker who can trick a user into clicking a crafted authorization URL can inject duplicate HTTP parameters into the OAuth flow, causing the client application to prioritize attacker-supplied values over server-authoritative data - potentially hijacking the authentication process or gaining unauthorized resource access. No public exploit has been identified and EPSS (0.08%, 23rd percentile) signals low real-world exploitation probability; however, the authentication bypass impact is meaningful in identity-sensitive deployments.

Technical ContextAI

Keycloak is a widely-deployed open-source identity and access management (IAM) platform supporting OAuth 2.0 and OpenID Connect (OIDC) flows. The root cause is CWE-1288 (Improper Validation of Consistency within Input), which in this context manifests as HTTP parameter pollution - a technique where duplicate query parameters in a crafted URL are resolved inconsistently by different components in the authentication chain (e.g., the authorization server versus the relying-party client application). When a Keycloak client is registered with overly broad redirect URI patterns (wildcards or prefix-matching rather than exact URIs), an attacker can insert duplicate authorization parameters (such as state, redirect_uri, or code) into the authorization request URL. The downstream client processes these polluted parameters out of intended precedence order, acting on attacker-supplied values instead of those set by the authorization server. No CPE strings were provided in the available data, so exact affected package versions cannot be confirmed from this source alone.

RemediationAI

The primary remediation is to enforce strict, exact-match redirect URI registration for all Keycloak OAuth/OIDC clients - replacing any wildcard, prefix-based, or broadly permissive URI patterns with fully-qualified exact URIs. This directly eliminates the misconfiguration prerequisite required for exploitation; the trade-off is that legitimate applications must have all valid redirect URIs explicitly enumerated, which requires a URI audit across registered clients. For patch availability and exact fixed versions, consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9689 - no specific patched Keycloak version was confirmed in the available input data, so a version upgrade recommendation cannot be made with confidence at this time. Additionally, review the Keycloak admin console for any clients with URI patterns containing wildcards (e.g., '*' or broad domain-level matches) and restrict them immediately as a compensating control while awaiting vendor patch guidance.