{"id":"CVE-2026-9800","published":"2026-06-25T16:16:27Z","modified":"2026-10-20T04:28:57Z","title":"Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison","vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","tier":"tail","description":{"text":"A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00651,"percentile":0.51088,"provenance":"source"},"cwes":[{"id":"CWE-1025","name":"Comparison Using Wrong Factors"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30049","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30083","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30084","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36002","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36013","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482472","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9800.json","tags":["x_sadp-csaf-vex"]}],"priority":{"score":15.9,"factors":[{"name":"EPSS percentile","points":10.22},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.4.SP2","versions":["all versions"]}],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":["<26.6.4"],"patched":["26.6.4"],"from":["GHSA-f5p5-6xmx-p252"],"provenance":"source"},{"ecosystem":"Maven","package":"org.keycloak:keycloak-policy-enforcer","vulnerableRanges":["<26.0.10"],"patched":["26.0.10"],"from":["GHSA-f5p5-6xmx-p252"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-39471","exploited":false,"provenance":"source"}}