The vulnerability exists in Keycloak's Authorization Services PathMatcher component, which fails to normalize URIs before matching them to security policies. This improper normalization allows an authenticated attacker to craft URLs with additional characters (e.g., trailing slashes or matrix parameters) that cause the system to apply less restrictive security policies than intended. Consequently, this enables bypass of explicit "Deny" policies and unauthorized access to restricted or administrative resources. Red Hat rates this vulnerability as Important and assigns a CVSS v3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The issue affects the Red Hat build of Keycloak 26.4, and a security update is available in version 26.4.14. The vendor advisory and errata provide detailed information and remediation instructions.

Authenticated users with low privileges can exploit this vulnerability to bypass fine-grained authorization controls and gain unauthorized access to administrative or restricted areas. This poses a significant risk to the confidentiality and integrity of the protected system. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Red Hat has released an updated package, Red Hat build of Keycloak 26.4.14, which addresses this vulnerability along with other security issues. Users should back up their existing installations and apply the update promptly to remediate the issue. No alternative mitigations are specified in the advisory. Patch status is confirmed by the vendor advisory and errata.