CVE-2026-9800
A flaw was found in Keycloak Policy Enforcer.
Published Jun 25, 2026 · updated Oct 14, 2026 · Red Hat Red Hat build of Keycloak 26.4
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Timeline
Detection, updates, and resolution for this record.
Jun 25, 2026 · NIST NVD
Detected
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Affected
- cpe redhat/build of keycloakversion unspecified
- vendor Red Hat Red Hat build of Keycloak 26.4version unspecified
- vendor Red Hat Red Hat build of Keycloak 26.4.13version unspecified
- vendor Red Hat Red Hat build of Keycloak 26.4.14version unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-9800
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, e
vulnerability.circl.lu - CVE.orgCVE-2026-9800
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-9800
30-day exploitation probability 0.7%
first.org - NIST NVDCVE-2026-9800
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, e
nvd.nist.gov