A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-9689 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2481845 | Issue Tracking Vendor Advisory |
Configurations
History
03 Jun 2026, 15:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Redhat build Of Keycloak |
|
| CPE | cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:* | |
| References | () https://access.redhat.com/security/cve/CVE-2026-9689 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2481845 - Issue Tracking, Vendor Advisory |
27 May 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 12:17
Updated : 2026-06-03 15:42
NVD link : CVE-2026-9689
Mitre link : CVE-2026-9689
CVE.ORG link : CVE-2026-9689
JSON object : View
Products Affected
redhat
- build_of_keycloak
CWE
CWE-1288
Improper Validation of Consistency within Input