Keycloak has authentication bypass via jwt algorithm confusion

At a glance

org.keycloak:keycloak-services: Amber, patch this week. Keycloak Policy Enforcer has a flaw that allows any authenticated user to bypass authorization policies by including the access-denied page path in a request URL. This allows unauthorized access to protected resources.

The flaws

• CVE-2026-11800: Keycloak has authentication bypass via jwt algorithm confusion (CVSS 8.1)
• CVE-2026-9800: Keycloak vulnerable to authorization bypass via incorrect uri comparison (CVSS 8.1 · EPSS 1%)
• CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass (CVSS 7.3 · EPSS 1%)
• CVE-2026-9705: Keycloak: Attacker can re-enable and take over disabled clients via registration access token (CVSS 6.5 · EPSS 0%)

The fix

Fix: Upgrade to version 26.6.4 for keycloak-services or 26.0.10 for keycloak-policy-enforcer

Who is exposed: {'products': ['Keycloak'], 'packages': [{'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-services', 'vulnerable': '< 26.6.4'}, {'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-policy-enforcer', 'vulnerable': '< 26.0.10'}]}

Where it stands

• No known exploitation

Connects to

• Same weakness: CWE-347 (CWE-347). 88 other warnings in 30 days
• Same product: Earlier org.keycloak:keycloak-services warnings. 2 in the last 90 days