{"id":"CVE-2026-74909","published":"2026-09-16T15:17:43.447","lastModified":"2026-09-18T18:17:12.197","description":"Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:68276","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:68277","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:68278","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:68280","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-74909","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517354","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in Keycloak's policy enforcer allows an authenticated user to manipulate web addresses with special encoded characters, potentially bypassing intended security policies and gaining unauthorized access.","exploitability":"Exploitation requires an authenticated user with knowledge of the specific encoded characters and the targeted security policy. This makes it moderately difficult to exploit.","blast_radius":"If exploited, an attacker could gain unauthorized access to sensitive administrative or private application endpoints, leading to potential data breaches or unauthorized actions.","remediation":"Upgrade to the latest version of Keycloak, as the specific version with this fix is not mentioned in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","policy-enforcer"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:45:28.086Z"}}