The vulnerability exists in the PathMatcher utility of Keycloak's Authorization Services, which does not normalize URIs correctly before matching them against security policies. By adding extraneous characters like trailing slashes or matrix parameters to a URL, an authenticated attacker can cause the system to apply a less restrictive security policy than intended. This results in an authorization bypass allowing access to restricted or administrative resources. Red Hat has rated the security impact as Important and assigned a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The issue requires authentication but enables bypass of explicit deny policies, threatening confidentiality and integrity. Red Hat has not yet provided a patch or official remediation guidance, and the vulnerability is under investigation with no known exploits in the wild.

An authenticated user can bypass fine-grained authorization controls by exploiting the lack of URI normalization in the PathMatcher component. This bypass allows access to administrative or restricted areas that should be protected, posing a significant risk to the confidentiality and integrity of the system. There is no impact on availability. The vulnerability requires low privileges and no user interaction beyond authentication.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15573 for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor the vendor advisory for updates and apply patches once available. Since the vulnerability requires authentication, review and restrict user permissions as a precautionary measure until a fix is released.