CVE-2026-9800: Keycloak Policy Enforcer Authorization Bypass

Technical summary

The vulnerability exists in how Keycloak's Policy Enforcer handles authorization policy evaluation. The enforcer uses a configured access-denied page path as part of its policy logic, but fails to properly validate or sanitize this path when it appears in incoming requests. By including this path as a URL segment or query parameter, an authenticated attacker can cause the enforcer to skip or bypass policy checks—including role-based access control (RBAC), scope validation, and User-Managed Access (UMA) permission verification. The root cause is classified under CWE-1025 (Comparison Using Wrong Factors), suggesting the enforcer is comparing request paths incorrectly or incompletely. This allows the attacker to access resources that should be protected by these policies.

Business impact

Organizations deploying Keycloak as an identity and access management (IAM) solution face a critical breach of their authorization model. Any employee, contractor, or service account that has gained initial authentication can escalate their access to protected resources without proper authorization. This could expose sensitive data, allow unauthorized actions on critical systems, and bypass compliance controls that depend on role and scope enforcement. The blast radius spans all applications protected by the compromised Keycloak instance. Data breaches, unauthorized transactions, and regulatory violations become possible depending on what the protected resources do. For organizations in regulated industries (healthcare, finance, government), this may trigger mandatory breach notification and investigation obligations.

Affected systems

Red Hat build of Keycloak is directly affected. Organizations running Keycloak for identity and access management, particularly those using Policy Enforcer for fine-grained authorization, are at risk. Any application or service relying on Keycloak's policy enforcement for access control—including applications using role-based access, scope-based access, or User-Managed Access (UMA) models—inherits this vulnerability. Organizations should verify whether they are running Keycloak in a configuration where Policy Enforcer is active and responsible for authorization decisions.

Exploitability

Exploitability is high. The attack requires only valid authentication credentials, which many organizations assume their users possess legitimately. The exploit itself is straightforward: append or include the access-denied page path in a request URL. No special tooling or code execution is necessary; a simple HTTP request with the path manipulation is sufficient. No user interaction is required beyond the attacker making the malicious request. The main barrier is knowing the configured access-denied page path, which may be guessable or discoverable through reconnaissance. The CVSS vector (AV:N/AC:L/PR:L) reflects network accessibility and low attack complexity once authentication is obtained. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of the attack means exploitation could emerge rapidly once public details circulate.

Remediation

Apply patches from Red Hat for the affected build of Keycloak. Verify the specific patch version against Red Hat's advisory, as the exact version depends on your current deployment branch. Organizations should prioritize patching Keycloak instances that enforce authorization policies for sensitive applications or data. In the interim, monitor access logs for suspicious requests containing the access-denied page path, implement additional network-level access controls if possible, and review Keycloak configurations to understand which applications depend on Policy Enforcer. Consider temporarily restricting authentication to trusted networks if the risk is judged critical.

Patch guidance

Contact Red Hat or consult their security advisories for the exact patch version applicable to your build of Keycloak. Red Hat typically releases patches for multiple active versions; identify your current version and apply the corresponding patch. Test patches in a non-production environment first to ensure no disruption to applications dependent on Keycloak policy enforcement. Patching should be treated as urgent given the ease of exploitation. Organizations should establish a change window for Keycloak patches that minimizes impact on dependent applications and plan for coordinated testing with application teams.

Detection guidance

Monitor Keycloak access and audit logs for requests that include the configured access-denied page path within the URL (as path segments or query parameters). Look for patterns where authenticated users are accessing resources outside their assigned roles or scopes—a successful exploitation attempt will show authorization bypass behavior. Review Policy Enforcer logs for skipped or incomplete policy evaluations. If you do not know your access-denied page path, check Keycloak's policy enforcer configuration in your deployment. Hunt for unusual authorization decisions that contradict the policies you have defined, especially if paired with suspicious request URLs. Correlate Keycloak logs with application logs to identify whether authorization decisions made by Keycloak align with actual access patterns in protected resources.

Why prioritize this

This vulnerability ranks HIGH (CVSS 8.1) and merits immediate attention because it directly undermines authorization—the core security boundary in any identity and access management system. The attack requires only authentication (a low bar in most organizations) and is trivial to execute. The impact is complete bypass of role, scope, and UMA permissions, affecting confidentiality and integrity of protected resources. It is not yet on the KEV catalog, but the simplicity of the exploit suggests public PoC code or active exploitation could emerge soon. Organizations relying on Keycloak for access control to sensitive data or systems should treat this as a critical remediation priority.

Risk score, explained

The CVSS score of 8.1 (HIGH) reflects: (1) network-accessible attack vector requiring no special position; (2) low attack complexity once authenticated; (3) requirement for valid user credentials (PR:L), a relatively low bar given the number of legitimate users most organizations have; (4) high impact to confidentiality (can access restricted data) and integrity (can perform unauthorized actions), and no impact to availability. The score does not account for the widespread deployment of Keycloak in identity-critical roles across many organizations, which further increases real-world risk. The vulnerability is a direct authorization bypass affecting the trust boundary between authentication and protected resources.

Frequently asked questions