CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
Other sources
Keycloak Authorization Services resolves request URIs to protected Resources using PathMatcher (org.keycloak.common.util.PathMatcher), which performs purely lexical segment comparison with no URI normalization. Appending a matrix parameter (;x=1) or trailing / to a restricted resource URI causes it to miss the exact match and fall through to a broader, more permissive resource (e.g., the default / catch-all). An authenticated low-privilege user can obtain a granted RPT or positive authorization decision for resources the policy explicitly denies them. The vulnerability affects the UMA grant endpoint, the Protection API matchingUri resolution, and the client-side policy enforcer—all of which share the same unguarded PathMatcher.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15573?
The severity of CVE-2026-15573 is high with a score of 8.1.
How do I fix CVE-2026-15573?
To fix CVE-2026-15573, ensure that Keycloak is updated to the latest version where the vulnerability is patched.
What impact does CVE-2026-15573 have on my system?
CVE-2026-15573 allows an attacker to perform an authorization bypass, potentially gaining unauthorized access to protected resources.
Which component of Keycloak is affected by CVE-2026-15573?
The PathMatcher component of Keycloak's Authorization Services is affected by CVE-2026-15573.
What can an attacker do with CVE-2026-15573?
An attacker can exploit CVE-2026-15573 by manipulating request URIs to bypass authorization checks.