Keycloak's policy enforcer is designed to protect applications by matching incoming web requests against defined security policies. However, it fails to correctly normalize URIs containing special encoded characters such as semicolons or directory traversal segments. This allows an authenticated user to manipulate the URI encoding to bypass authorization checks, potentially accessing restricted administrative or private endpoints. The vulnerability is a direct bypass of authorization controls due to incomplete URI normalization, representing a regression from a prior fix (CVE-2026-15573). Red Hat has assessed this vulnerability as Important (high severity) due to its impact on confidentiality, integrity, and access control. No vendor-provided patch or effective mitigation is currently available.

Successful exploitation allows an authenticated attacker to bypass authorization controls and access sensitive administrative or private application endpoints that should be restricted. This can lead to unauthorized reading and modification of application data and files, privilege escalation, and potential denial of service through resource exhaustion. The vulnerability affects confidentiality, integrity, and access control, with no direct impact on availability beyond potential DoS scenarios from resource consumption.

As per the Red Hat advisory, no effective mitigation or patch is currently available that meets criteria for ease of use, applicability, or stability. Users should monitor the vendor advisory for updates and apply any future official fixes once released. Until then, restricting access to trusted authenticated users and minimizing exposure of sensitive endpoints may reduce risk.