Missing Authorization in Keycloak - CVE-2026-74909
Published: September 18, 2026
Vulnerability identifier: #VU150836
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74909
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to sensitive administrative or private application endpoints.
The vulnerability exists due to missing authorization in the Keycloak policy enforcer when processing web addresses containing specially encoded characters. A remote user can send a request containing encoded semicolons or directory traversal segments to cause the enforcer to apply a less restrictive security policy.
Affected software
Keycloak
How to mitigate CVE-2026-74909
Install security update from vendor's website.
Keycloak - update to 26.7.4