Security Advisory: Keycloak Policy Enforcer Authorization Bypass (CVE-2026-9800)

Products

• Service Virtualization

Issue/Introduction

A security vulnerability was identified in the Keycloak Policy Enforcer. This flaw allows an authenticated user to bypass established authorization policies—including role scope and User-Managed Access (UMA) permission checks—by including the configured access-denied page path within a request URL (as either a path segment or a query parameter). This manipulation can lead to unauthorized access to protected resources.

CVSS Score: 8.1 CVE ID: CVE-2026-9800

Environment

• Component: IAM(Keycloak Policy Enforcer)
• Affected Versions: All versions prior to 10.9.2.

Resolution

This issue is addressed in version 10.9.2. Customers are advised to upgrade to version 10.9.2 or later to mitigate this vulnerability.