Summary

PolicyEnforcer.isDefaultAccessDeniedUri uses a substring match (String.contains) instead of an exact path comparison to determine whether an incoming request targets the configured access-denied page. When the check matches, the request is short-circuited as granted — skipping all role checks, scope checks, and UMA permission evaluation. Any authenticated user can bypass every authorization policy by including the on-deny-redirect-to value anywhere in the request URL (as a path segment or query parameter).

Requirements to exploit

Any authenticated user with a valid access token. No specific role, scope, or UMA permission required. The attacker needs to know the on-deny-redirect-to value, which defaults to /access-denied and is trivially discoverable by triggering a deny and observing the redirect location.

Component affected: org.keycloak.keycloak-policy-enforcer

Version affected: 26.0.5 (latest on Maven Central) and all prior versions containing PolicyEnforcer.isDefaultAccessDeniedUri

Patch available: no

File issue trackers? Yes, for all supported release streams

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High)

Embargo: yes (High severity, complete authorization bypass. Suggested date: 19-Aug-2026)

Acknowledgement:

Bas Levering <basdaniel3>

Steps to reproduce

1. Deploy an application using keycloak-policy-enforcer with on-deny-redirect-to set to /access-denied (or any value) 2. Obtain a valid access token for any authenticated user (no specific roles required) 3. Send a request to a protected endpoint with /access-denied appended to the path: GET /api/protected-resource/access-denied 4. Alternatively, append it as a query parameter: GET /api/protected-resource?x=/access-denied 5. The request is granted without any authorization evaluation — no role check, no scope check, no UMA permission check runs