Web Application Security Flaw in Keycloak's Policy Enforcer by Red Hat

CVE-2026-74909

What is CVE-2026-74909?

A vulnerability exists in Keycloak's policy enforcer, which is responsible for safeguarding applications by assessing incoming web requests against specified security protocols. The flaw arises from the enforcer's inability to correctly normalize web addresses imbued with specially encoded characters, such as semicolons and directory traversal indicators. This deficiency permits an authenticated user to exploit these encoded characters, tricking the enforcer into applying a more lenient security posture than intended. Consequently, this oversight could allow unauthorized access to sensitive administrative or private endpoints within the application.

References