An incomplete fix for CVE-2026-15573 in Keycloak PathMatcher allows an authenticated attacker to bypass authorization policies. The original fix introduced URI normalization to strip matrix parameters and resolve dot segments, but this cleanup occurs before percent-decoding. Consequently, percent-encoded semicolons (percent-3B) and percent-encoded dot segments (percent-2Epercent-2E) bypass the normalization logic. When the Keycloak policy enforcer is used with a servlet container that decodes these characters during routing (such as Tomcat or WildFly), the enforcer matches the request against a permissive catch-all resource while the container routes the request to a restricted endpoint. This allows a low-privilege user to access protected resources that should be denied by the configured policy.

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.