CVE-2026-15573 is a security flaw in Keycloak's Authorization Services where the PathMatcher component fails to properly normalize URIs before comparing them to security policies. This improper normalization enables an authenticated user to bypass explicit "Deny" policies by adding extra characters like trailing slashes or matrix parameters to URLs, causing the system to apply less restrictive policies than intended. The vulnerability allows unauthorized access to administrative or restricted resources, posing a significant risk to confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 8.1 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope. Red Hat has rated this vulnerability as Important and acknowledges the risk it poses. No explicit patch or fixed version information is provided in the advisory, and the affected versions are not specified.

Authenticated users can bypass fine-grained authorization controls and access administrative or restricted areas they should not have permission to see. This compromises the confidentiality and integrity of protected systems but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat is investigating affected products and may release fixes in the near future. Until a fix is available, users should be aware of the risk posed by URI normalization issues in Keycloak's PathMatcher and consider applying any available mitigations or workarounds recommended by Red Hat or Keycloak. Monitoring vendor advisories and upgrading to fixed versions once released is advised.