PT-2026-43682 · Keycloak · Keycloak

Martin Bartoš · Published 2026-05-27 · Updated 2026-06-03 · CVE-2026-9689

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in Keycloak, an open-source identity and access management solution, allows a remote attacker to manipulate the authentication process by crafting a special web address. This occurs when a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs). If a user clicks the link, the application may prioritize attacker-controlled information over legitimate data. This issue is a result of HTTP parameter pollution, which is the injection of multiple parameters with the same name into an HTTP request to confuse the application logic, potentially leading to security bypasses or unauthorized resource access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1288

Related Identifiers

CVE-2026-9689

Affected Products

Keycloak

References · 5

• https://access.redhat.com/security/cve/CVE-2026-9689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9689 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2481845 · Vendor Advisory
• https://t.me/cveNotify/164828 · Telegram Post
• https://t.me/cveNotify/165820 · Telegram Post