CVE-2026-9800

Name of the Vulnerable Software and Affected Versions Keycloak Policy Enforcer (affected versions not specified)

Description An issue exists that allows authenticated users to bypass authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. An attacker can gain unauthorized access to protected resources by including the configured access-denied page path within a request URL, either as a path segment or a query parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.