EUVD-2026-80829
GHSA-5639-qg9x-rw29
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Authenticated low-privilege user over network (PR:L, AV:N, AC:L) bypasses authorization to reach admin/private endpoints, allowing sensitive read and modification (C:H/I:H) with no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
AnalysisAI
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application be deployed behind the Keycloak/Red Hat SSO policy enforcer with defined path-based security policies - the flaw is in the enforcer's URL normalization of encoded characters (encoded semicolons and directory-traversal segments), so an application not using the policy enforcer is unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, above-average priority for organizations running Keycloak/Red Hat SSO as an authorization gateway, though not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: apply the Red Hat errata released for this CVE - RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278 and RHSA-2026:68280 (https://access.redhat.com/errata/RHSA-2026:68276), which cover the Red Hat Build of Keycloak and Red Hat Single Sign-On 7 packages; exact patched build numbers are not enumerated in the supplied data, so verify the fixed version in each advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployment that uses the policy enforcer for path-based authorization, flag those exposed to untrusted networks or third-party/low-privileged account populations, and pull access logs for requests containing encoded semicolons (%3B) or directory-traversal segments directed at administrative or restricted paths to determine whether the bypass has been exercised. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severit
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today