AIKIDO-2026-91957

TL;DR

The Keycloak policy enforcer compares request URIs incorrectly when matching the configured access-denied page path. By placing that path inside a request URL as a path segment or query parameter, an authenticated user can make the enforcer treat protected requests as the public access-denied page. This bypasses all role, scope, and UMA permission checks and grants access to protected resources. The fix corrects the URI comparison so the access-denied path no longer disables enforcement.