CVE-2026-74909 in Keycloak
Summary
by MITRE • 09/17/2026
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability in Keycloak's policy enforcement mechanism represents a critical authentication bypass and authorization flaw rooted in improper input normalization of Uniform Resource Identifiers (URIs). The core technical issue lies within the logic that processes incoming web requests against defined security policies. When an authenticated user submits a request, the system is expected to normalize the URI path to ensure consistent matching against policy rules. However, the implementation fails to adequately handle special encoded characters, specifically those representing semicolons and directory traversal sequences such as dot-dot-slash. This failure in normalization creates a discrepancy between how the web server or reverse proxy interprets the request path and how Keycloak's internal policy engine evaluates it for access control decisions.
This technical flaw allows an attacker to manipulate the URI structure using URL encoding techniques to obscure the true intent of the request. By inserting encoded semicolons, which are sometimes treated as parameter separators in certain web server configurations but not properly normalized by the application layer, or by utilizing directory traversal sequences, the user can craft a path that bypasses restrictive policy checks. The security policies typically define specific paths and methods allowed for different roles. When normalization fails, the enforcer may match the encoded request against a more permissive rule set than intended, effectively treating it as a public or less restricted resource rather than a protected administrative endpoint. This misalignment enables unauthorized access to sensitive areas of the application that should be strictly guarded by role-based access controls.
The operational impact of this vulnerability is severe for any organization relying on Keycloak for centralized identity and access management. An authenticated attacker, even with low-privilege credentials, can exploit this flaw to escalate privileges or access confidential data residing in administrative interfaces. This could lead to the exposure of user personal information, modification of system configurations, or complete compromise of the authentication infrastructure if administrative endpoints are accessed. The ability to bypass policy enforcement undermines the fundamental security model provided by Keycloak, rendering role-based restrictions ineffective against crafted requests that exploit these encoding anomalies.
From a standards perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function in certain contexts where access control is bypassed through path manipulation. It also maps to the MITRE ATT&CK framework technique T1530 Data from Cloud Storage Object Misconfiguration if it leads to data exfiltration, but more accurately reflects T1078 Valid Accounts combined with T1190 Exploit Public-Facing Application, as the attacker leverages valid credentials and a web application vulnerability to gain unauthorized access. The specific mechanism of using encoded characters to bypass path-based restrictions is characteristic of issues found in CWE-601 URL Redirection to Untrusted Site or CWE-284 Improper Access Control where input normalization is insufficient.
Mitigation strategies must focus on ensuring robust URI canonicalization before policy evaluation occurs. Developers and administrators should verify that the version of Keycloak being used includes patches for this specific normalization flaw, as upstream fixes typically involve updating the request parsing logic to strictly normalize all encoded characters into their standard forms prior to matching against security policies. Additionally, implementing a Web Application Firewall (WAF) with rules designed to detect and block anomalous URI patterns containing excessive encoding or traversal sequences can provide an additional layer of defense. It is also advisable to review access control configurations to ensure that critical administrative endpoints are protected by multiple layers of verification beyond simple path matching, such as requiring explicit role checks at the controller level rather than relying solely on policy enforcer rules for initial filtering.