{"id":"CVE-2026-9800","kind":"vulnerability","aliases":["CVE-2026-9800","GHSA-f5p5-6xmx-p252"],"related":[],"title":"Keycloak vulnerable to authorization bypass via incorrect uri comparison","description":"### Description\nA flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.","summary":"Keycloak Policy Enforcer compares request URIs incorrectly, so any logged-in user can include the configured access-denied page path in a request and skip role, scope and UMA permission checks. An attacker who already has a valid account can reach protected resources they should not see.","severity":"high","cvss":8.1,"epss":0.00651,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":["26.6.4"],"affected":"< 26.6.4","ecosystem":"maven"},{"name":"org.keycloak:keycloak-policy-enforcer","fixed":["26.0.10"],"affected":"< 26.0.10","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":["26.4.13"],"affected":">= 26.4, < 26.4.13","ecosystem":"vendor"},{"name":"redhat build of keycloak","fixed":[],"affected":">= 26.6, <= 26.6.4","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["authorization","cwe-1025","java","keycloak","package","self-hosted"],"not_affected_if":["auth-required-not-true","no-policy-enforcer"],"how_to_check":"- Check the Maven dependencies for `org.keycloak:keycloak-services` and `org.keycloak:keycloak-policy-enforcer` and compare against the fixed versions below.\n- Look for the Policy Enforcer configuration and whether an access-denied page path is set (unknown if the sources give a file or setting name).","fix":"- `keycloak-services`: upgrade to `26.6.4` or later\n- `keycloak-policy-enforcer`: upgrade to `26.0.10` or later","status":"open","published_at":"2026-06-25T17:17:04+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:42+00:00","updated_at":"2026-10-29T16:56:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:39:42Z","model":"claude-haiku-5-5","output":{"fix":"- `keycloak-services`: upgrade to `26.6.4` or later\n- `keycloak-policy-enforcer`: upgrade to `26.0.10` or later","reach":"internet","title":"Keycloak Policy Enforcer: authenticated users bypass all authorization policies via URL","impact":"high","summary":"Keycloak Policy Enforcer compares request URIs incorrectly, so any logged-in user can include the configured access-denied page path in a request and skip role, scope and UMA permission checks. An attacker who already has a valid account can reach protected resources they should not see.","audience":"developers","category":"package","nicknames":[],"who_cares":["keycloak","java","self-hosted","authorization"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reaches protected resources without required permissions","analyst_note":"Confirm the Policy Enforcer configuration conditions and the exact access-denied path setting in the GHSA-f5p5-6xmx-p252 advisory.","how_to_check":"- Check the Maven dependencies for `org.keycloak:keycloak-services` and `org.keycloak:keycloak-policy-enforcer` and compare against the fixed versions below.\n- Look for the Policy Enforcer configuration and whether an access-denied page path is set (unknown if the sources give a file or setting name).","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required-not-true","no-policy-enforcer"],"who_is_affected":"Applications that use Keycloak Policy Enforcer to protect resources with role, scope or UMA policies are exposed, and any user with a valid login can exploit it. The sources do not say which deployment setups are affected beyond the configured access-denied page path. Teams that do not use Policy Enforcer, or only use Keycloak for login without these policies, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4283,"output_tokens":685,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1025':40B '-2026':11A,19A '-9800':12A,20A '6xmx':16A 'access':65B,123C,132C,154C 'access-deni':64B,131C 'account':87B 'allow':107C 'alreadi':83B 'attack':81B,150C 'authent':109C 'author':4A,38B,114C 'build':31A,35A 'bypass':5A,112C 'check':79B,126C 'compar':50B 'comparison':9A 'configur':63B,130C 'cve':10A,18A 'cwe':39B 'deni':66B,133C 'descript':96C 'either':140C 'enforc':49B,104C 'enforcer':29A 'f5p5':15A 'flaw':98C 'found':100C 'gain':152C 'ghsa':14A 'ghsa-f5p5-6xmx-p252':13A 'host':46B 'includ':61B,116C,128C 'incorrect':7A,53B 'java':41B 'keycloak':1A,23A,27A,33A,37A,42B,47B,102C 'keycloak-policy-enforcer':26A 'keycloak-services':22A 'log':57B 'logged-in':56B 'manag':122C 'of':32A,36A 'org.keycloak':21A,25A 'p252':17A 'packag':43B 'page':67B,134C 'paramet':148C 'path':68B,135C,143C 'permiss':78B,125C 'polici':48B,103C,115C 'policy':28A 'protect':90B,156C 'queri':147C 'reach':89B 'redhat':30A,34A 'request':51B,71B,138C 'resourc':91B,157C 'role':74B,117C 'scope':75B,118C 'see':95B 'segment':144C 'self':45B 'self-host':44B 'services':24A 'skip':73B 'uma':77B,124C 'unauthor':153C 'uri':8A,52B 'url':139C 'user':59B,110C,121C 'user-manag':120C 'valid':86B 'via':6A 'vulner':2A,106C 'within':136C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Keycloak Policy Enforcer to protect resources with role, scope or UMA policies are exposed, and any user with a valid login can exploit it. The sources do not say which deployment setups are affected beyond the configured access-denied page path. Teams that do not use Policy Enforcer, or only use Keycloak for login without these policies, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-06-25T17:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f5p5-6xmx-p252","url":"https://github.com/advisories/GHSA-f5p5-6xmx-p252","severity":"high","published_at":"2026-10-29T16:37:26+00:00","modified_at":"2026-10-29T16:37:29+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:39:02+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9800","severity":null,"published_at":"2026-06-25T17:17:04+00:00","modified_at":"2026-10-20T05:16:55+00:00","first_seen_at":"2026-10-29T16:56:32+00:00","fetched_at":"2026-10-29T16:56:32+00:00","note":null}],"documents":[{"id":17811,"url":"https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-f5p5-6xmx-p252","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17812,"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-f5p5-6xmx-p252","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":18033,"url":"https://access.redhat.com/errata/RHSA-2026:30049","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18034,"url":"https://access.redhat.com/errata/RHSA-2026:30050","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18035,"url":"https://access.redhat.com/errata/RHSA-2026:30083","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18036,"url":"https://access.redhat.com/errata/RHSA-2026:30084","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18057,"url":"https://access.redhat.com/security/cve/CVE-2026-9800","title":"Vendor advisory: access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18058,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","title":"Vendor advisory: bugzilla.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: bugzilla.redhat.com"},{"id":18059,"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json","title":"Vendor advisory: security.access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: security.access.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}