CVE-2026-9800: Comparison Using Wrong Factors in Red Hat Red Hat build of Keycloak 26.4
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
AI Analysis
Technical Summary
CVE-2026-9800 is an authorization bypass vulnerability in the Keycloak Policy Enforcer component of Red Hat build of Keycloak 26.4. The flaw arises from incorrect URI comparison logic that allows an authenticated user to bypass role, scope, and UMA permission checks by including the configured access-denied page path in the request URL, either as a path segment or query parameter. This results in unauthorized access to protected resources. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Red Hat has published advisories and released updated packages in version 26.4.13 to address this and other related security issues.
Potential Impact
Exploitation of this vulnerability allows any authenticated user to bypass all authorization policies enforced by Keycloak, including role-based, scope-based, and UMA permission checks. This leads to unauthorized access to protected resources, potentially exposing sensitive data or functionality. The vulnerability does not impact availability but has high confidentiality and integrity impacts.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address CVE-2026-9800 along with multiple other security issues. Users should apply these official security updates as soon as possible. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations or workarounds are documented. Patch status is confirmed by Red Hat advisories linked in the vendor advisory URLs.
CVE-2026-9800: Comparison Using Wrong Factors in Red Hat Red Hat build of Keycloak 26.4
Description
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
CVSS v3.1
Score 8.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-9800 is an authorization bypass vulnerability in the Keycloak Policy Enforcer component of Red Hat build of Keycloak 26.4. The flaw arises from incorrect URI comparison logic that allows an authenticated user to bypass role, scope, and UMA permission checks by including the configured access-denied page path in the request URL, either as a path segment or query parameter. This results in unauthorized access to protected resources. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Red Hat has published advisories and released updated packages in version 26.4.13 to address this and other related security issues.
Potential Impact
Exploitation of this vulnerability allows any authenticated user to bypass all authorization policies enforced by Keycloak, including role-based, scope-based, and UMA permission checks. This leads to unauthorized access to protected resources, potentially exposing sensitive data or functionality. The vulnerability does not impact availability but has high confidentiality and integrity impacts.
Mitigation Recommendations
Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address CVE-2026-9800 along with multiple other security issues. Users should apply these official security updates as soon as possible. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations or workarounds are documented. Patch status is confirmed by Red Hat advisories linked in the vendor advisory URLs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-05-28T04:00:06.454Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-9800","vendor":"Red Hat"}]
Threat ID: 6a3d5b514853345fc13372dd
Added to database: 06/25/2026, 16:46:09 UTC
Last enriched: 08/06/2026, 13:03:54 UTC
Last updated: 08/08/2026, 13:40:17 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.