CVE-2026-9800
EUVD-2026-3947125.06.2026, 17:17
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | build_of_keycloak | 26.4 ≤ 𝑥 < 26.4.13 |
| redhat | build_of_keycloak | 26.6 ≤ 𝑥 ≤ 26.6.4 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.13-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.14-1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.4-2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-8 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
Vulnerability Media Exposure
References