GHSA-79qw-g39g-mfxcHigh· 8.1▾ TwilightDuplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-f5p5-6xmx-p252. This link is maintained to preserve external references.
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
org.keycloak:keycloak-services < 26.6.4org.keycloak:keycloak-policy-enforcer < 26.0.10Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9083Medium· 4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9086High· 7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token