This vulnerability arises from improper validation of consistency within input parameters in Keycloak's OIDC redirect URI handling. Specifically, when a client is configured to accept broad or wildcard redirect URIs, an attacker can exploit HTTP parameter pollution by crafting authorization URLs with duplicated response parameters. If the client application prioritizes the first occurrence of these parameters ('first-wins' strategy), it may process attacker-controlled data over legitimate data, potentially bypassing security controls or gaining unauthorized access. The vulnerability is contingent on client behavior and requires user interaction (clicking a malicious link). Red Hat's advisory references CWE-1288 and assigns a CVSS 3.1 score of 4.2 (medium severity). The vendor advisory does not explicitly state a patch for this specific CVE alone but references a Keycloak 26.4.14 update that addresses multiple vulnerabilities including CVE-2026-9689.

The impact is limited to confidentiality and integrity with low severity, as the vulnerability could allow an attacker to bypass security measures or gain unauthorized access by manipulating OIDC response parameters. There is no impact on availability. Exploitation requires user interaction and depends on the client application's handling of duplicate query parameters. No known exploits are reported in the wild.

Red Hat has released Keycloak 26.4.14 which includes fixes for CVE-2026-9689 among other vulnerabilities. Users should upgrade to this version to remediate the issue. Until the update is applied, mitigation involves avoiding the use of wildcard redirect URIs in client configurations and reviewing client application behavior regarding duplicate query parameters. Red Hat's advisory does not indicate that no action is required; therefore, applying the official update is recommended.