CVE-2026-87743 in Build of Keycloak
Summary
by MITRE • 09/18/2026
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Quarkus HTTP security represents a critical authentication bypass flaw rooted in path normalization inconsistencies within the application framework's request handling pipeline. This issue arises from a discrepancy between how the security matcher evaluates URL paths for public versus protected status and how subsequent HTTP request dispatchers process those same paths for routing purposes. In secure web applications, it is imperative that all stages of request processing agree on the canonical representation of a resource path to ensure consistent policy enforcement. When this agreement breaks down, attackers can exploit the divergence by crafting specific URLs that contain non-normalized characters or sequences which are interpreted differently at different layers of the stack. Specifically, an unauthenticated attacker can manipulate the URL structure such that the security layer perceives the request as targeting a public resource, thereby skipping authentication checks, while the underlying dispatcher resolves the path to a protected endpoint requiring authorization. This mismatch effectively creates a backdoor through standard HTTP routing mechanisms, allowing unauthorized entities to access sensitive data or execute privileged operations without valid credentials.
From a technical perspective, this flaw is characteristic of CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Destination if the normalization logic fails to canonicalize input correctly before comparison. The core issue lies in the failure to apply consistent path resolution rules across the security filter chain and the servlet or reactive routing engine. In many Java-based frameworks, including Quarkus which often runs on top of Undertow or Netty, URL decoding and path segment processing can vary depending on whether the request is being evaluated for access control policies or dispatched to a specific handler method. If one layer performs percent-decoding while another does not, or if directory traversal sequences like dot-dot-slash are handled differently by the matcher versus the dispatcher, an attacker can construct payloads that slip through the initial security gate. For instance, using encoded slashes or redundant path segments might cause the security module to classify a request as safe based on its raw form, while the runtime environment resolves it to a restricted internal resource after normalization during dispatch.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of access control mechanisms that protect sensitive application endpoints. An attacker leveraging this flaw can bypass authentication requirements entirely, gaining unauthorized read or write access to protected APIs, user data, administrative functions, or configuration files depending on what resources are exposed through the misrouted paths. This type of authorization bypass is particularly dangerous because it does not require brute force attacks or credential theft; instead, it relies on a logic error in the framework's request processing pipeline that can be exploited remotely and automatically. The ability to access sensitive information without detection undermines trust in the application security posture and may lead to data breaches, regulatory non-compliance, and significant reputational damage for organizations relying on Quarkus for their backend services.
Mitigation strategies must focus on ensuring strict consistency between path normalization logic used by security components and those used by request dispatchers. Developers should verify that all incoming requests are canonicalized using a standardized algorithm before any access control decisions are made, ensuring that the representation of the path remains identical throughout the processing chain. It is recommended to upgrade Quarkus to versions where this specific discrepancy has been addressed in upstream patches or security releases. Additionally, implementing defense-in-depth measures such as strict input validation and avoiding reliance solely on framework-level default behaviors for access control can reduce risk. Security teams should also employ automated vulnerability scanning tools configured to detect path traversal and normalization bypass patterns during the testing phase of development lifecycle to identify similar issues before deployment. Monitoring logs for unusual URL structures that deviate from expected canonical formats can provide early detection indicators for potential exploitation attempts in production environments.