AIKIDO-2026-305512
keycloak-common is vulnerable to Authorization Bypass
76
High Risk
This Affects:
keycloak-commonTL;DR
The internal path matcher used by Authorization Services compares raw, unnormalized request URIs against policy patterns. Trailing slashes, matrix parameters, dot-segments, or percent-encoding can make a request match a looser policy than intended and reach a restricted path. The fix normalizes URIs before matching them against authorization policies.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and rely on Authorization Services or policy-enforcer URI-based policies to restrict access to specific paths.
Background info
keycloak-common is vulnerable to Authorization Bypass in versions 2.0.0 - 26.7.0.
How to fix this
Upgrade the org.keycloak:keycloak-common library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:50846access.redhat.com/errata/RHSA-2026:50847access.redhat.com/errata/RHSA-2026:50848access.redhat.com/errata/RHSA-2026:50849access.redhat.com/security/cve/CVE-2026-15573bugzilla.redhat.com/show_bug.cgi?id=2499593
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant