HighVulnerabilityCVE-2026-9800updated 29 Oct 2026, 16:37 UTC

Keycloak Policy Enforcer lets logged-in users bypass access rules

Keycloak is a login and access system. A flaw lets any signed-in user skip the access rules that normally block them from some pages, by putting a specific page address into the web request.

Fix availableOfficial source

Severity	HighCVSS 8.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesorg.keycloak:keycloak-services 26.6.4; org.keycloak:keycloak-policy-enforcer 26.0.10 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Signed-in userHas a valid login but limited rights
2Crafted requestAdds access-denied page path to URL
3Policy check skippedRole, scope, and UMA checks bypassed
4Protected resourceAccessed without authorization
ResultUnauthorized access to protected resources

What happened

In Keycloak Policy Enforcer, including the configured access-denied page path in a request URL, as a path segment or query parameter, bypasses role, scope, and UMA permission checks.

Why it is dangerous: An authenticated user can reach protected resources they should not be allowed to see or use, so sensitive data or functions behind Keycloak policies may be exposed.

Are you affected?

You are affected if you run keycloak-services below 26.6.4 or keycloak-policy-enforcer below 26.0.10 and use Policy Enforcer with role, scope, or UMA policies.

Package / product	Affected versions	Fixed in
org.keycloak:keycloak-services · maven	< 26.6.4	26.6.4
org.keycloak:keycloak-policy-enforcer · maven	< 26.0.10	26.0.10

What to do

Update keycloak-services to 26.6.4 or later
Update keycloak-policy-enforcer to 26.0.10 or later
Review logs for requests containing the access-denied page path in the URL

Timeline

29 Oct 2026, 16:37 UTC
Publicly disclosed
29 Oct 2026, 16:37 UTC
Reported by GitHub Advisory · GitHub Advisory
29 Oct 2026, 16:37 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Keycloak vulnerable to authorization bypass via incorrect uri comparisonGitHub Advisory · 29 Oct 2026, 16:37 UTC

Technical details

ID: CVE-2026-9800 · GHSA-f5p5-6xmx-p252
CVSS: 8.1 / 10
EPSS: 0.7% chance of exploitation within 30 days
Disclosed: 29 Oct 2026, 16:37 UTC
On Zero Radar: 29 Oct 2026, 16:37 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works