8.1

CVE-2026-74909

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.4
Default Statusaffected
Version 26.4.16-2
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.4
Default Statusaffected
Version 26.4-26
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.4
Default Statusaffected
Version 26.4-26
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.4.16
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.4.16
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.6
Default Statusaffected
Version 26.6.7-3
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.6
Default Statusaffected
Version 26.6-20
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.6
Default Statusaffected
Version 26.6-20
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.6.7
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Keycloak 26.6.7
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Single Sign-On 7
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.89% 0.579
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://access.redhat.com/security/cve/CVE-2026-74909
https://bugzilla.redhat.com/show_bug.cgi?id=2517354
https://access.redhat.com/errata/RHSA-2026:68276
https://access.redhat.com/errata/RHSA-2026:68277
https://access.redhat.com/errata/RHSA-2026:68278
https://access.redhat.com/errata/RHSA-2026:68280