CVE-2026-9800: CVE-2026-9800: Authorization Bypass in Keycloak Policy Enforcer via Unnormalized URI Substring Matching

#security #cve #cybersecurity

CVE-2026-9800: Authorization Bypass in Keycloak Policy Enforcer via Unnormalized URI Substring Matching

Vulnerability ID: CVE-2026-9800
CVSS Score: 8.1
Published: 2026-10-29

CVE-2026-9800 is an authorization bypass vulnerability affecting the Keycloak Policy Enforcer (org.keycloak:keycloak-policy-enforcer), which is integrated into Red Hat build of Keycloak, Red Hat build of Quarkus, Red Hat Single Sign-On 7, and Red Hat JBoss Enterprise Application Platform Expansion Pack. The flaw stems from improper comparison logic in the PolicyEnforcer.isDefaultAccessDeniedUri method, which uses loose substring matching on the full raw request URI rather than exact, normalized path comparisons against the configured access-denied landing page. Consequently, an authenticated attacker possessing any valid low-privileged token can bypass role-based, scope-based, and User-Managed Access (UMA) policy evaluations by embedding the access-denied path segment into the URL path or query parameters.

TL;DR

A loose substring check (String.contains) in Keycloak Policy Enforcer's PolicyEnforcer.isDefaultAccessDeniedUri method allows any authenticated user to bypass all authorization checks by appending the configured access-denied URI (defaulting to /access-denied) as a URL path segment or query parameter.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Authorization Bypass via Improper URI Comparison
CWE ID: CWE-1025 (Comparison Using Wrong Factors)
CVSS v3.1 Score: 8.1 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Affected Method: PolicyEnforcer.isDefaultAccessDeniedUri
Attack Vector: Network (HTTP Query Parameter or Subpath Injection)
EPSS Score: 0.651% (51.09th Percentile)
Exploit Status: Proof-of-Concept Documented (Not in CISA KEV)

Affected Systems

Keycloak Policy Enforcer (org.keycloak:keycloak-policy-enforcer)
Red Hat build of Keycloak 26.4
Red Hat build of Keycloak 26.6
Red Hat build of Quarkus 3.27
Red Hat build of Quarkus 3.33
Red Hat Single Sign-On 7
Red Hat JBoss Enterprise Application Platform Expansion Pack (EAP XP)
org.keycloak:keycloak-policy-enforcer: <= 26.0.5 (Fixed in: 26.0.10.redhat-00001)
Red Hat build of Keycloak 26.4: >= 26.4.0, <= 26.4.12 (Fixed in: 26.4.13-1)
Red Hat build of Keycloak 26.6: >= 26.6.0, <= 26.6.4 (Fixed in: 26.6.4-2)
Red Hat build of Quarkus 3.27: 3.27.4.SP2 (Fixed in: 26.0.10.redhat-00001)
Red Hat build of Quarkus 3.33: 3.33.2.SP2 (Fixed in: 26.0.10.redhat-00001)

Exploit Details

Red Hat Bugzilla: Functional Proof-of-Concept and reproduction steps documented in vendor bug report RHBZ#2482472.

Mitigation Strategies

Upgrade embedded Keycloak Policy Enforcer and Quarkus Keycloak Authorization adapter libraries across all resource servers and microservices.
Remove or unset the 'on-deny-redirect-to' property in stateless REST APIs so that the policy enforcer defaults to standard HTTP 403 responses without evaluating redirect exemptions.
Implement reverse proxy or WAF inspection rules to block HTTP requests containing the access-denied path string inside query parameters or subpaths.

Remediation Steps:

Audit all Java servlet and Quarkus applications to identify dependencies on 'org.keycloak:keycloak-policy-enforcer' or 'io.quarkus:quarkus-keycloak-authorization'.
Update Red Hat build of Keycloak adapters to version 26.4.13-1 / 26.6.4-2 or later, and Red Hat build of Quarkus dependencies to 26.0.10.redhat-00001 or later.
Rebuild and redeploy all affected client applications and microservices to ensure the updated policy enforcer bytecode is active in runtime containers.
Verify remediation by sending an authenticated test request with '?test=/access-denied' appended to a restricted endpoint and confirming that an HTTP 403 Forbidden response is returned.

References

Read the full report for CVE-2026-9800 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community