CVE-2026-15573

highPriorität · verfolgen · 0EPSS 0.005 · 40. PerzentilDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (40th) EPSS

CVSS 8.1 · high

Is it mine?

19 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-27

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 2.8 · Auswirkung 5.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-551USprimärCWE-178US

betroffene Produkte (19)

Betroffene Produkte und Versionsbereiche.

Open Source Keycloak Red Hat build of Keycloa <26.4-22alle Versionencert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.4.14-1alle Versionencert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6-11alle Versionencert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6.5-1alle Versionencert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6.5-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4-22cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4.14-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6-11cert_bundDE
Red Hat Red Hat build of Keycloak 26.4< 26.4-22enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4.14-1enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6-11enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6.5-1enisa_euvdEU
redhat build of keycloak26.4 → 26.4.14nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat build of keycloak26.6 → 26.6.5nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat data grid= 8.0nvdUScpe:2.3:a:redhat:data_grid:*:*:*:*:*:*:*:*
redhat jboss enterprise application platform expansion packalle VersionennvdUScpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:*:*:*:*:*:*:*:*
redhat single sign-on= 7.0nvdUScpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
Bitnami keycloak26.4.0 → 26.4.14osvUSpkg:bitnami/keycloak
Bitnami keycloak26.6.0 → 26.6.5osvUSpkg:bitnami/keycloak

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-2677RedHat Build of Keycloak: Mehrere SchwachstellenDeutsch2026-08-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Administratorrechte zu erlangen, Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.
BIT-keycloak-2026-15573Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher2026-08-25vendor · osvUS
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

veröffentlicht 2026-08-05geändert 2026-08-31

verwandt (33)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-34429US	medium5.3OT hoch	99.3% (100th)	Exploit	2021-07-15
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or byp…
CVE-2021-28164US	medium5.3OT hoch	82.4% (100th)	Exploit	2021-04-01
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources withi…
CVE-2021-28165US	high7.5	53.9% (99th)	Exploit	2021-04-01
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2023-23924US	critical9.8OT hoch	3.57% (89th)	Exploit	2023-02-01
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary o…
CVE-2022-29165US	critical10.0	2.10% (82nd)	—	2022-05-20
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 and prior to versions…

+28 weitere

Referenzen (18)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan