CVE-2026-15573

Summary

The flaw in Keycloak's PathMatcher allows attackers to bypass intended security policies by manipulating URL paths, potentially gaining unauthorized access to administrative or restricted areas.

Exploitability

Exploitation requires an authenticated user and the ability to modify URL paths, making it moderately difficult.

Blast radius

If exploited, the impact could be significant, as it allows access to sensitive areas that should be restricted.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Keycloak version 18.0.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.