Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Red Hat Keycloak may bypass security policy with encoded URLs

CVE-2026-74909 · published 1 month ago
Summary

The Red Hat build of Keycloak (versions 26.4, 26.4.16, 26.6, 26.6.7) and Red Hat Single Sign-On 7 can be tricked by an authenticated user who adds specially encoded characters to a web address. These characters confuse the policy enforcer, causing it to apply a weaker rule and potentially expose administrative or private pages. Apply the latest patches from Red Hat or upgrade to a version where the URL‑normalisation fix is fully implemented.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
red hat red hat build of keycloak 26.4 All versions
red hat red hat build of keycloak 26.4.16 All versions
red hat red hat build of keycloak 26.6 All versions
red hat red hat build of keycloak 26.6.7 All versions
red hat red hat single sign-on 7 All versions
Original advisory text
Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Sources
CVE-2026-74909 · NVD
CVE-2026-74909 · MITRE
Track software like this
Free during beta