Executive brief
A security flaw in the Keycloak Policy Enforcer allows any logged-in user to bypass all security checks and access protected resources. By simply adding a specific text string (the 'access denied' page path) to a web address, an attacker can trick the system into granting access without checking their permissions. This could lead to unauthorized access to sensitive data or administrative functions across applications relying on Keycloak for security.
Technical details
A vulnerability exists in the Keycloak Policy Enforcer due to an incorrect URI comparison in the 'PolicyEnforcer.isDefaultAccessDeniedUri' method. The component uses a substring match (String.contains) rather than an exact path comparison to identify the configured access-denied page. If the access-denied path is detected anywhere within the request URL—including as a path segment or a query parameter—the enforcer short-circuits the authorization logic and grants access. An authenticated attacker with a valid token can exploit this to bypass role, scope, and User-Managed Access (UMA) permission checks. The vulnerability affects the 'org.keycloak.keycloak-policy-enforcer' library up to version 26.0.5.
Affected products
- Red Hat Red Hat Build of Keycloak
- Keycloak keycloak-policy-enforcer up to 26.0.5
Timeline
- 2026-05-28: other: Reported to Red Hat Bugzilla
- 2026-06-25: advisory: NVD publication date