CVE-2026-9689
Description
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat build_of_keycloak | No range specified | — |
| org.keycloak:keycloak-servicesMaven | 26.5.0 ≤ v ≤ 26.6.4, v ≤ 26.4.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.