CyberSecBulletin
CVE-2026-9800NVD status: Modified

Red Hat build of Keycloak 26.4: Comparison Using Wrong Factors

Published Updated By the CyberSecBulletin desk

CVE-2026-9800 is a high-severity comparison using wrong factors vulnerability in Red Hat build of Keycloak 26.4 from Red Hat, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 0.65% chance of exploitation within 30 days, higher than 52% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Build Of Keycloak to 26.4.13 or a later version.
  2. Read the advisory on access.redhat.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Red HatRed Hat build of Keycloak 26.4Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.4.13Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.4.14Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.6Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.6.4Not specified in the recordNot stated
Red HatRed Hat build of Quarkus 3.27.4.SP2Not specified in the recordNot stated
Red HatRed Hat build of Quarkus 3.33.2.SP2Not specified in the recordNot stated
Red HatRed Hat build of QuarkusNot specified in the recordNot stated
Red HatRed Hat JBoss Enterprise Application Platform Expansion PackNot specified in the recordNot stated
Red HatRed Hat Single Sign-On 7Not specified in the recordNot stated
Red HatBuild Of Keycloak26.4 up to, but not including, 26.4.13; 26.6 through 26.6.426.4.13

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. Scored by CNA (redhat.com).

Scoring systemScoreSeverityScored by
CVSS 3.18.1HighCNA (redhat.com)
CVSS 3.18.1HighCNA

Official description

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Comparison Using Wrong Factors

The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities.

More Comparison Using Wrong Factors vulnerabilities (CWE-1025)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Red Hat build of Keycloak 26.4

All Red Hat build of Keycloak 26.4 vulnerabilities

Recent Comparison Using Wrong Factors vulnerabilities

Spotted an error? Tell us.