CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 8.1. Exploitation may require the attacker to be authenticated.
CVE
CVE-2026-9800
Severity
HIGH
CVSS
8.1
EPSS
0.31%
Original NVD Description
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
Related CVEs
Other vulnerabilities affecting the same vendor(s)