Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-74909

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.16-2 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-26 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-26 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.16

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4.16

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6.7-3 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-20 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-20 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6.7

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6.7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

References