CVE-2026-74909: Keycloak Auth Bypass Vulnerability

CVE-2026-74909 Overview

CVE-2026-74909 is an authorization bypass vulnerability in the Keycloak policy enforcer. The enforcer protects applications by matching incoming web requests against defined security policies. It fails to correctly normalize web addresses containing special encoded characters, such as encoded semicolons or directory traversal segments. An authenticated user can craft requests with these encoded characters to trick the enforcer into applying a less restrictive policy than intended. Successful exploitation grants unauthorized access to sensitive administrative or private application endpoints. The flaw is tracked under [CWE-862] (Missing Authorization) and impacts confidentiality and integrity of protected resources.

Critical Impact
Authenticated attackers can bypass Keycloak policy enforcement using URL-encoded characters to reach protected administrative and private endpoints.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE Analysis CVE-2026-74909)
Red Hat Single Sign-On distributions referenced in RHSA-2026:68276 and RHSA-2026:68277
Additional Red Hat packages covered by RHSA-2026:68278 and RHSA-2026:68280

Discovery Timeline

2026-09-16 - CVE-2026-74909 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-74909

Vulnerability Analysis

The Keycloak policy enforcer intercepts incoming HTTP requests and evaluates the target path against a set of protected resource patterns. Authorization decisions rely on the normalized request path matching a policy rule. When the path contains percent-encoded characters such as encoded semicolons (%3B) or traversal segments (%2E%2E%2F), the enforcer does not fully canonicalize the value before matching. This inconsistency allows a crafted URL to bypass the pattern used to protect a sensitive endpoint while still routing to the underlying resource in the backing application. The result is a Missing Authorization condition where an authenticated principal reaches endpoints that policy would otherwise deny.

Root Cause

The root cause is improper URL normalization inside the policy enforcer. Path segments containing encoded delimiters and dot segments are compared against policy patterns before decoding and canonicalization are complete. The enforcer and the downstream application therefore disagree on what path is being requested. This class of defect is a well-known parser differential and maps to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires network access and valid low-privilege credentials. An attacker sends an HTTP request to an application protected by the Keycloak policy enforcer, embedding encoded characters in the request path. The enforcer matches the request against a permissive policy while the application resolves the path to a restricted endpoint. No user interaction is required. For technical details, see the Red Hat CVE Analysis CVE-2026-74909 and Red Hat Bug Report #2517354.

No verified public proof-of-concept code is available. Refer to the vendor advisory for exploitation specifics.

Detection Methods for CVE-2026-74909

Indicators of Compromise

Requests to Keycloak-protected applications containing encoded delimiters such as %3B, %2F, %2E%2E, or double-encoded variants in the path segment.
Successful HTTP 200 responses on administrative or private endpoints from user accounts that lack the corresponding resource role.
Policy enforcer decision logs showing permit outcomes for paths that also produce sensitive backend responses.

Detection Strategies

Enable verbose policy enforcer logging and alert on decisions where the requested URI contains percent-encoded delimiters or traversal sequences.
Correlate reverse proxy access logs with Keycloak authorization events to detect enforcer-versus-application path mismatches.
Baseline expected paths for each protected resource and flag deviations that include encoded characters.

Monitoring Recommendations

Ingest Keycloak audit events and web server access logs into a centralized analytics platform for cross-source correlation.
Monitor administrative endpoint access counts per user and alert on statistical anomalies from low-privilege accounts.
Track HTTP 200 responses on admin URIs preceded by enforcer permit decisions to identify possible bypass activity.

How to Mitigate CVE-2026-74909

Immediate Actions Required

Apply the Keycloak updates referenced in RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280 as soon as maintenance windows allow.
Audit all applications behind the policy enforcer and confirm which protected resources are exposed to authenticated users.
Rotate credentials and session tokens for accounts observed accessing administrative endpoints through suspicious paths.

Patch Information

Red Hat has published fixed packages through multiple errata. Consult Red Hat CVE Analysis CVE-2026-74909 for the authoritative list of fixed versions and update instructions per product.

Workarounds

Place a normalizing reverse proxy in front of Keycloak-protected applications to canonicalize percent-encoded segments before the enforcer evaluates the request.
Configure the fronting proxy or web application firewall to reject requests containing %2E%2E, %3B, or double-encoded delimiters in path segments where they are not required.
Restrict administrative endpoints to trusted network segments until the patched Keycloak version is deployed.

bash

# Example reject rule for a normalizing reverse proxy
# Deny requests containing encoded traversal or delimiter sequences in the path
location / {
    if ($request_uri ~* "(%2e%2e|%3b|%25)") {
        return 400;
    }
    proxy_pass http://keycloak_backend;
}