CVE-2026-9800: build of keycloak from 26.4 (inclusive), before 26.4.13 (exclusive), from 26.6 (inclusive), through 26.6.4…

Affected technology

build of keycloak · from 26.4 (inclusive), before 26.4.13 (exclusive)
redhat

build of keycloak · from 26.6 (inclusive), through 26.6.4 (inclusive)
redhat

Red Hat build of Keycloak 26.4 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.4.13 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.4.14 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.6 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Keycloak 26.6.4 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Quarkus 3.27.4.SP2 · Exact affected versions not specified by the source
Red Hat

Red Hat build of Quarkus 3.33.2.SP2 · Exact affected versions not specified by the source
Red Hat

Red Hat JBoss Enterprise Application Platform Expansion Pack · Exact affected versions not specified by the source
Red Hat

Red Hat Single Sign-On 7 · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. Vendor/CNA’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none.