ai.wanaku:wanaku-router-backend (0.2.0), io.quarkus:quarkus-keycloak-authorization (>=3.18.0.cr1, <=3.37.0) +3 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (>=26.0.3, <=26.0.9)

org.keycloak:keycloak-policy-enforcer MAVEN version =26.0.3, =3.18.0.cr1, =3.18.0.cr1, =3.2.0, =26.0.6, =26.0.9 Source cves: CVE-2026-9800 Source advisory: OSV:GHSA-F5P5-6XMX-P252...

org.keycloak:keycloak-adapter-core (24.0.0), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.0) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.0)

org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 24.0.0 -...

io.quarkus:quarkus-keycloak-authorization (>=3.14.0.cr1, <=3.15.0), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.14.0.cr1, <=3.15.0) potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (25.0.2)

org.keycloak:keycloak-policy-enforcer MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - io.quarkus:quarkus-keycloak-authorization =3.14.0.cr1, =3.14.0.cr1, =3.15.0 Source...

com.ritense.valtimo:keycloak-iam (>=12.0.0.release, <=12.1.3.release), com.ritense.valtimo:valtimo-dependencies (>=12.0.0.release, <=12.1.3.release) +7 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.3)

org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - com.ritense.valtimo:keycloak-iam =12.0.0.release, =12.0.0.release, =12.0.0.release,...

org.keycloak:keycloak-adapter-core (24.0.1), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.1) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.1)

org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 24.0.1 -...

org.keycloak:keycloak-adapter-core (22.0.2), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.2) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.2)

org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 22.0.2 -...

io.quarkus:quarkus-keycloak-authorization (3.7.0.cr1), io.quarkus:quarkus-keycloak-authorization-deployment (3.7.0.cr1) +8 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (23.0.3)

org.keycloak:keycloak-policy-enforcer MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - io.quarkus:quarkus-keycloak-authorization 3.7.0.cr1 -...

de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (>=2.3.4, <=2.8.2), de.fraunhofer.iosb.ilt.frost-server:frost-server.http (>=2.3.4, <=2.8.0) +17 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (25.0.3)

org.keycloak:keycloak-policy-enforcer MAVEN version 25.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak =2.3.4, =2.3.4, =2.4....

Keycloak vulnerable to authorization bypass via incorrect uri comparison

Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either a...

EUVD-2026-39471

Keycloak vulnerable to authorization bypass via incorrect uri comparison...

de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (2.2.1), de.fraunhofer.iosb.ilt.frost-server:frost-server.http (2.2.1) +14 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (23.0.0)

org.keycloak:keycloak-policy-enforcer MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak 2.2.1 -...

org.keycloak:keycloak-adapter-core (22.0.0), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.0) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.0)

org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 22.0.0 -...

com.ritense.valtimo:keycloak-iam (>=10.6.0.release, <=11.3.5.release), com.ritense.valtimo:valtimo-dependencies (>=10.6.0.release, <=11.3.5.release) +17 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (21.1.0)

org.keycloak:keycloak-policy-enforcer MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - com.ritense.valtimo:keycloak-iam =10.6.0.release, =10.6.0.release, =0.126, =0.126,...

io.quarkus:quarkus-keycloak-authorization (>=3.15.1, <=3.17.8), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.15.1, <=3.17.8) potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (25.0.6)

org.keycloak:keycloak-policy-enforcer MAVEN version 25.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - io.quarkus:quarkus-keycloak-authorization =3.15.1, =3.15.1, =3.17.8 Source cves:...

it.maconsultingitalia.keycloak:spring-boot-keycloak-policy-enforcer (1.0.0) potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (25.0.1)

org.keycloak:keycloak-policy-enforcer MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - it.maconsultingitalia.keycloak:spring-boot-keycloak-policy-enforcer 1.0.0 Source cve...

de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (2.3.2), de.fraunhofer.iosb.ilt.frost-server:frost-server.http (2.3.2) +12 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.4)

org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak 2.3.2 -...

org.eclipse.dirigible:dirigible-application (>=8.6.1, <=8.7.0), org.eclipse.dirigible:dirigible-components-security-keycloak (>=8.6.1, <=8.7.0) +6 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (21.1.2)

org.keycloak:keycloak-policy-enforcer MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.eclipse.dirigible:dirigible-application =8.6.1, =8.6.1, =8.7.0 -...

com.abavilla:fpi-bot-api (>=1.8.1, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.8.1, <=1.8.5) +26 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (22.0.1)

org.keycloak:keycloak-policy-enforcer MAVEN version 22.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - com.abavilla:fpi-bot-api =1.8.1, =1.8.1, =1.8.6, =1.8.6, =1.9.0, =1.9.0, =1.10.1,...

org.keycloak:keycloak-adapter-core (24.0.2), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.2) +4 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-policy-enforcer (24.0.2)

org.keycloak:keycloak-policy-enforcer MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-policy-enforcer and may be impacted: - org.keycloak:keycloak-adapter-core 24.0.2 -...

GHSA-F5P5-6XMX-P252 Keycloak vulnerable to authorization bypass via incorrect uri comparison

Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either a...