AIKIDO-2026-229938

TL;DR

The Keycloak policy enforcement compares request URIs incorrectly when matching the configured access-denied page path. By placing that path inside a request URL as a path segment or a query parameter, an authenticated user can make the server treat protected requests as the public access-denied page. This bypasses all role, scope, and UMA permission checks and grants access to protected resources. The fix corrects the URI comparison so the access-denied path no longer disables enforcement.