CVE-2026-15573

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An issue exists in the Authorization Services of Keycloak. The PathMatcher component, which matches request paths to security policies, fails to properly normalize URIs before comparison. An authenticated user can bypass security restrictions by adding extra characters, such as trailing slashes or matrix parameters, to a URL. This manipulation tricks the system into applying a less restrictive security policy, granting unauthorized access to administrative or restricted areas.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.