CVE-2026-9800 is an authorization bypass vulnerability in Keycloak Policy Enforcer. Authenticated users can circumvent all authorization policies by manipulating the request URL to include the configured access-denied page path, either as a path segment or query parameter. This flaw allows unauthorized access to protected resources by bypassing role, scope, and UMA permission checks. The vulnerability is addressed by Red Hat in the Keycloak 26.4.13 update, which includes security fixes for this and other issues.

The vulnerability allows authenticated users to gain unauthorized access to protected resources by bypassing all authorization policies, potentially leading to exposure of sensitive data or unauthorized actions within applications relying on Keycloak for access control. The CVSS 3.1 base score is 8.1 (High), reflecting high confidentiality and integrity impact without availability impact.

Red Hat has released an official fix in Keycloak version 26.4.13. Users should update to this version or later to remediate the vulnerability. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other specific mitigations are indicated by the vendor advisory.