A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass
    all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By
    including the configured access-denied page path within a request URL, either as a path segment or a query
    parameter, an attacker can gain unauthorized access to protected resources. (CVE-2026-9800)

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control     over the realm. (CVE-2026-9099)

  - An authentication bypass exists via JWT algorithm confusion, allowing unauthorized access.
    (CVE-2026-11800)

  - Any authenticated user can bypass all authorization policies, including role, scope, and UMA     permission checks, by including the configured access-denied page path within a request URL, gaining     unauthorized access to protected resources. (CVE-2026-9800)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
477904	SCA: security update for org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services (GHSA-f5p5-6xmx-p252)	Tenable Cloud Security	SCA Checks	Local	high
477904	SCA: security update for org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services (GHSA-f5p5-6xmx-p252)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
324966	Keycloak < 26.6.4 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-9800

high

Tenable Plugins

high

high

high