CVE-2026-9689: Keycloak HTTP parameter pollution in OIDC redirect URI

CVE-2026-9689 · Severity: medium · CVSS 4.2 · Published 2026-05-27

Keycloak, a widely used identity and access management tool, is vulnerable to a security bypass when configured with broad redirect rules. An attacker can trick a user into clicking a malicious link that manipulates the login process, potentially allowing the attacker to gain unauthorized access to the user's account or sensitive resources. This occurs because the system fails to properly check for duplicate information in web addresses during the authentication flow.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9689 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9689 being exploited in the wild.
How severe is CVE-2026-9689?
Medium severity, with a CVSS score of 4.2, published 27 May 2026.
Which products and versions are affected?
Keycloak All versions prior to 26.7.0; specifically 26.5.0 to 26.6.4 and versions up to 26.4.7; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.5.0,last_affected=26.6.4; Red Hat build of Keycloak All versions.
Is there a fix for CVE-2026-9689?
A patch was published on 2026-06-18: Fix merged into Keycloak main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9689 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9689?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in Keycloak's OIDC implementation within the `keycloak-services` package. When a client is configured with a wildcard redirect URI (e.g., http://localhost:8080/*), the `OIDCRedirectUriBuilder.addParam()` method fails to validate if the incoming redirect URI already contains reserved OIDC response parameters like 'code', 'state', or 'iss'. An attacker can craft an authorization URL containing these parameters; upon successful authentication, Keycloak appends its own legitimate parameters without checking for duplicates. If the client application uses a 'first-wins' parsing strategy for duplicate query parameters, it may trust the attacker-controlled values instead of the legitimate ones generated by Keycloak. This vulnerability is addressed in Keycloak 26.7.0, 26.6.5, and 26.4.14.

Affected products

  • Keycloak Keycloak All versions prior to 26.7.0; specifically 26.5.0 to 26.6.4 and versions up to 26.4.7
  • Red Hat Red Hat Build of Keycloak All versions

Identifiers

  • CVE-2026-9689
  • GHSA-wcvj-vpvw-9rr5

Timeline

  • 2026-05-27: disclosed: Vulnerability reported and CVE-2026-9689 assigned
  • 2026-05-27: advisory
  • 2026-06-18: patched: Fix merged into Keycloak main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.