The vulnerability in Red Hat Build of Keycloak's Policy Enforcer arises from improper comparison logic involving the access-denied page path. Authenticated users can exploit this by crafting request URLs that include the configured access-denied page path, bypassing all authorization checks such as roles, scopes, and UMA permissions. This flaw effectively allows unauthorized access to protected resources. The CVSS 3.1 base score is 8.1, indicating a high severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. No vendor advisory details on remediation or affected versions are currently provided.

An attacker with valid authentication can bypass all authorization policies in Keycloak, gaining unauthorized access to protected resources. This compromises confidentiality and integrity of the protected data and services. Availability is not impacted. The vulnerability affects access control mechanisms critical to secure authorization enforcement.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9800 for current remediation guidance. Until an official fix is available, consider restricting access to the configured access-denied page path and monitoring for unusual access patterns involving this path. Avoid relying solely on the Policy Enforcer for authorization enforcement in affected deployments.