Keycloak CVE-2026-9800 (GHSA-f5p5-6xmx-p252): Policy Enforcer authorization bypass by putting the access-denied page path in the URL. Which versions fix it?

What it is: Keycloak's Policy Enforcer (used by Java apps and adapters to enforce Keycloak Authorization Services: roles, scopes and UMA permissions on URLs) compared request URIs incorrectly. Any logged-in user could bypass all authorization policies by including the configured access-denied page path in the request URL, as a path segment or a query parameter, and reach protected resources. Published October 29, 2026 (high); Red Hat shipped fixes for its builds. A companion advisory the same day (CVE-2026-9086) fixed an XSS via case-insensitive redirect URI validation. Am I affected: - keycloak-services before 26.6.4 (Keycloak server), and keycloak-policy-enforcer before 26.0.10 used inside your applications. - Only deployments that rely on the Policy Enforcer / Authorization Services for access control, with an access-denied page configured (on-deny-redirect-to / onDenyRedirectTo). Apps that only use OIDC login and check roles in their own code aren't affected by this bug. - Check the server version in the admin console (Server info) and the keycloak-policy-enforcer version in your app's dependency tree (mvn dependency:tree / gradle dependencies). Fix: 1. Upgrade the Keycloak server to 26.6.4 or later (or the Red Hat build of Keycloak errata RHSA-2026:30049 / 30050 / 30083). 2. Upgrade keycloak-policy-enforcer in every application that embeds it to 26.0.10 or later, rebuild and redeploy; the server upgrade alone doesn't fix the library inside your apps. 3. Until then, as defense in depth, add authorization checks in the application or at a gateway for the most sensitive endpoints, and review logs for requests that contain the access-denied path in unusual places. Verify: the server reports 26.6.4+, your apps ship keycloak-policy-enforcer 26.0.10+, and a test request with the access-denied path appended to a protected URL is still denied. Sources: https://github.com/keycloak/keycloak/security/advisories/GHSA-f5p5-6xmx-p252 https://nvd.nist.gov/vuln/detail/CVE-2026-9800 https://access.redhat.com/errata/RHSA-2026:30049