GHSA-79qw-g39g-mfxc

Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison

Published

2026-06-25

Modified

2026-10-29

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f5p5-6xmx-p252. This link is maintained to preserve external references. ### Original Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-79qw-g39g-mfxc