Low severity3.7NVD Advisory· Published Jan 15, 2026· Updated Apr 15, 2026
CVE-2026-0976
CVE-2026-0976
Description
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-quarkus-serverMaven | <= 26.2.5 | — |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.