CVE-2026-74909

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the policy enforcer used to protect applications by matching incoming web requests against security policies. The enforcer fails to correctly normalize web addresses containing special encoded characters, such as those representing directory traversal segments or semicolons. An authenticated user can exploit this by using encoded characters to bypass intended security restrictions, potentially gaining unauthorized access to private or administrative application endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.