This vulnerability in Red Hat Build of Keycloak involves improper validation of input consistency when client applications accept broad redirect URIs. An attacker can exploit HTTP parameter pollution by crafting a special URL that, if clicked by a user, may cause the client to incorrectly prioritize attacker-controlled parameters over legitimate ones during authentication. This can lead to bypassing security measures or unauthorized resource access. The CVSS 3.1 base score is 4.2 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction needed, and low confidentiality and integrity impact. No patch or official remediation level is currently confirmed by Red Hat. The vendor advisory is available at https://access.redhat.com/security/cve/CVE-2026-9689.

The vulnerability allows a remote attacker to manipulate the authentication process via HTTP parameter pollution when broad redirect URIs are accepted by the client application. This can lead to unauthorized access or bypassing security controls, impacting confidentiality and integrity at a low level. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9689 for current remediation guidance. Until an official fix is available, users should consider restricting accepted redirect URIs to narrow, well-defined values to reduce exposure to HTTP parameter pollution attacks. Monitor for updates from Red Hat and apply patches promptly once released.