{"id":"GHSA-79qw-g39g-mfxc","kind":"vulnerability","aliases":["GHSA-79qw-g39g-mfxc"],"related":[],"title":"Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f5p5-6xmx-p252. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.","summary":"This advisory is a withdrawn duplicate of GHSA-f5p5-6xmx-p252. The original text says any logged-in user can bypass role, scope and UMA permission checks in Keycloak Policy Enforcer by putting the access-denied page path in a request URL.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":[],"affected":"< 26.6.4","ecosystem":"maven"},{"name":"org.keycloak:keycloak-policy-enforcer","fixed":[],"affected":"< 26.0.10","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-1025","java","keycloak","maven","package","policy-enforcer"],"not_affected_if":["policy-enforcer-unused","unauthenticated-only"],"how_to_check":"- Check the Keycloak Maven dependency version for `org.keycloak:keycloak-services` and `org.keycloak:keycloak-policy-enforcer`\n- See the duplicate advisory GHSA-f5p5-6xmx-p252 for the current status and fixed versions","fix":"- `org.keycloak:keycloak-services`: fixed version unknown (sources list affected below 26.6.4)\n- `org.keycloak:keycloak-policy-enforcer`: fixed version unknown (sources list affected below 26.0.10)","status":"withdrawn","published_at":"2026-06-25T18:30:41+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:52+00:00","updated_at":"2026-10-29T16:39:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:39:52Z","model":"claude-haiku-5-5","output":{"fix":"- `org.keycloak:keycloak-services`: fixed version unknown (sources list affected below 26.6.4)\n- `org.keycloak:keycloak-policy-enforcer`: fixed version unknown (sources list affected below 26.0.10)","reach":"network","title":"Keycloak: URI comparison flaw lets users bypass authorization policies","impact":"high","summary":"This advisory is a withdrawn duplicate of GHSA-f5p5-6xmx-p252. The original text says any logged-in user can bypass role, scope and UMA permission checks in Keycloak Policy Enforcer by putting the access-denied page path in a request URL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","java","maven","policy-enforcer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reaches protected resources without authorization checks","analyst_note":"Advisory is withdrawn as a duplicate; confirm affected and fixed versions in GHSA-f5p5-6xmx-p252 before acting on this entry.","how_to_check":"- Check the Keycloak Maven dependency version for `org.keycloak:keycloak-services` and `org.keycloak:keycloak-policy-enforcer`\n- See the duplicate advisory GHSA-f5p5-6xmx-p252 for the current status and fixed versions","plain_action":"","needs_analyst":true,"not_affected_if":["policy-enforcer-unused","unauthenticated-only"],"who_is_affected":"Teams running Keycloak with the Policy Enforcer and access-denied page configured, where authenticated users reach protected resources. The sources list affected ranges below 26.6.4 for keycloak-services and below 26.0.10 for keycloak-policy-enforcer. Teams not using Policy Enforcer can likely skip it, but the sources do not say.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000782,"input_tokens":4305,"output_tokens":702,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1025':32B '6xmx':50B,101C '79qw':14A,19A 'access':77B,139C,148C,170C 'access-deni':76B,147C 'advisori':2A,41B,86C,88C 'allow':123C 'attack':166C 'authent':125C 'author':6A,130C 'bypass':7A,62B,128C 'check':68B,142C 'comparison':11A 'configur':146C 'cwe':31B 'deni':78B,149C 'descript':112C 'duplic':1A,45B,85C,96C 'either':156C 'enforc':39B,72B,120C 'enforcer':30A 'extern':109C 'f5p5':49B,100C 'flaw':114C 'found':116C 'g39g':15A,20A 'gain':168C 'ghsa':13A,18A,48B,99C 'ghsa-79qw-g39g-mfxc':12A,17A 'ghsa-f5p5-6xmx-p252':47B,98C 'includ':132C,144C 'incorrect':9A 'java':33B 'keycloak':3A,24A,28A,34B,70B,118C 'keycloak-policy-enforcer':27A 'keycloak-services':23A 'link':104C 'log':58B 'logged-in':57B 'maintain':106C 'manag':138C 'maven':35B 'mfxc':16A,21A 'org.keycloak':22A,26A 'origin':53B,111C 'p252':51B,102C 'packag':36B 'page':79B,150C 'paramet':164C 'path':80B,151C,159C 'permiss':67B,141C 'polici':38B,71B,119C,131C 'policy':29A 'policy-enforc':37B 'preserv':108C 'protect':172C 'put':74B 'queri':163C 'refer':110C 'request':83B,154C 'resourc':173C 'role':63B,133C 'say':55B 'scope':64B,134C 'segment':160C 'services':25A 'text':54B 'uma':66B,140C 'unauthor':169C 'uri':10A 'url':84B,155C 'user':60B,126C,137C 'user-manag':136C 'via':8A 'vulner':4A,122C 'withdrawn':44B,91C 'within':152C","nicknames":[],"mitigations":[],"who_affected":"Teams running Keycloak with the Policy Enforcer and access-denied page configured, where authenticated users reach protected resources. The sources list affected ranges below 26.6.4 for keycloak-services and below 26.0.10 for keycloak-policy-enforcer. Teams not using Policy Enforcer can likely skip it, but the sources do not say.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-06-25T18:30:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-79qw-g39g-mfxc","url":"https://github.com/advisories/GHSA-79qw-g39g-mfxc","severity":"high","published_at":"2026-06-25T18:30:41+00:00","modified_at":"2026-10-29T16:37:13+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:39:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}