CVE-2026-9800: Keycloak Policy Enforcer authorization bypass via incorrect URI comparison

CVE-2026-9800 · Severity: high · CVSS 8.1 · Published 2026-06-25

A security flaw in the Keycloak Policy Enforcer allows any logged-in user to bypass all security checks and access protected resources. By simply adding a specific text string (the 'access denied' page path) to a web address, an attacker can trick the system into granting access without checking their permissions. This could lead to unauthorized access to sensitive data or administrative functions across applications relying on Keycloak for security.

Technologies: org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9800 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9800 being exploited in the wild.
How severe is CVE-2026-9800?
High severity, with a CVSS score of 8.1, published 25 June 2026.
Which products and versions are affected?
Keycloak-Policy-Enforcer up to 26.0.5; org.keycloak:keycloak-policy-enforcer (Maven) < 26.0.10, ECOSYSTEM:introduced=0,fixed=26.0.10; org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4.
Is there a fix for CVE-2026-9800?
Yes. org.keycloak:keycloak-policy-enforcer (Maven): upgrade to 26.0.10 or later; org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9800 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9800?
Check whether you run Keycloak-Policy-Enforcer, org.keycloak:keycloak-policy-enforcer (Maven), org.keycloak:keycloak-services (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-policy-enforcer (Maven): upgrade to 26.0.10 or later
    # set org.keycloak:keycloak-policy-enforcer to 26.0.10 in your pom.xml or build.gradle
  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later
    # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Keycloak Policy Enforcer due to an incorrect URI comparison in the 'PolicyEnforcer.isDefaultAccessDeniedUri' method. The component uses a substring match (String.contains) rather than an exact path comparison to identify the configured access-denied page. If the access-denied path is detected anywhere within the request URL—including as a path segment or a query parameter—the enforcer short-circuits the authorization logic and grants access. An authenticated attacker with a valid token can exploit this to bypass role, scope, and User-Managed Access (UMA) permission checks. The vulnerability affects the 'org.keycloak.keycloak-policy-enforcer' library up to version 26.0.5.

Affected products

  • Red Hat Red Hat Build of Keycloak
  • Keycloak keycloak-policy-enforcer up to 26.0.5

Identifiers

  • CVE-2026-9800
  • BIT-KEYCLOAK-2026-9800
  • GHSA-f5p5-6xmx-p252

Timeline

  • 2026-05-28: other: Reported to Red Hat Bugzilla
  • 2026-06-25: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.