VYPR
Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jul 30, 2026

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

CVE-2026-9800

Description

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Affected products

1

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.