CVE-2026-74909

8.1 HIGH

Published 2026-09-16 · Updated 2026-09-18

AI risk analysis

Summary: The flaw in Keycloak's policy enforcer allows an authenticated user to manipulate web addresses with special encoded characters, potentially bypassing intended security policies and gaining unauthorized access.
Exploitability: Exploitation requires an authenticated user with knowledge of the specific encoded characters and the targeted security policy. This makes it moderately difficult to exploit.
Blast radius: If exploited, an attacker could gain unauthorized access to sensitive administrative or private application endpoints, leading to potential data breaches or unauthorized actions.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the latest version of Keycloak, as the specific version with this fix is not mentioned in the description.

auth-bypasswebpolicy-enforcer

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-862

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.