CVE-2026-9689

Description

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

Traduire en français

Produits concernés

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.14
• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.5
• Redhat build of keycloak

Scores CVSS

Faiblesses (CWE)

• CWE-1288

Références

• https://access.redhat.com/errata/RHSA-2026:50846
• https://access.redhat.com/errata/RHSA-2026:50847
• https://access.redhat.com/errata/RHSA-2026:50848
• https://access.redhat.com/errata/RHSA-2026:50849
• https://access.redhat.com/security/cve/CVE-2026-9689 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2481845 Issue TrackingVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories