CVE-2026-9799: Authorization Bypass via UMA Permission Ticket Wildcard in Keycloak

Vulnerability ID: CVE-2026-9799
CVSS Score: 4.6
Published: 2026-10-29

CVE-2026-9799 is an authorization bypass vulnerability in the User-Managed Access (UMA) subsystem of Keycloak (org.keycloak.authorization). When a resource server is configured with the non-default PERMISSIVE policy enforcement mode, an authenticated user holding a valid UMA permission ticket for a single typed resource can obtain an authorization Requesting Party Token (RPT) granting access to all resources of the same type across the resource server. By submitting an authorization request with the type selector prefix 'resource-type-any:', the attacker bypasses instance-level owner approval checks for unshared peer resources that lack explicit static administrative policies.

TL;DR

An authorization bypass in Keycloak's UMA policy evaluation engine allows authenticated users with a valid ticket for one typed resource to gain unauthorized access to all other user-owned resources of the same type when the resource server operates in PERMISSIVE enforcement mode.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-639: Authorization Bypass Through User-Controlled Key
  • CVSS v3.1 Score: 4.6 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
  • Affected Component: org.keycloak.authorization.policy.evaluation.DefaultPolicyEvaluator
  • Attack Vector: Network (OAuth 2.0 / UMA Token Endpoint)
  • Prerequisite Configuration: PolicyEnforcementMode.PERMISSIVE with ownerManagedAccess=true
  • EPSS Score: 0.29% (21.98th Percentile)
  • Exploit Status: Proof of Concept (Upstream Arquillian Integration Test)
  • CISA KEV Status: Not Listed

Affected Systems

  • Keycloak
  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.6
  • Keycloak: < 26.4.13 (Fixed in: 26.4.13)
  • Keycloak: >= 26.6, < 26.6.4 (Fixed in: 26.6.4)
  • Red Hat build of Keycloak: >= 26.4, < 26.4.13 (Fixed in: 26.4.13-1)
  • Red Hat build of Keycloak: >= 26.6, < 26.6.4 (Fixed in: 26.6.4-2)

Code Analysis

Commit: bdb4db3

Skip owner managed resources when enforcement mode is set to permissive (#692) Closes CVE-2026-9799

File: server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java @@ -44,10 +44,6 @@ public class DefaultPolicyEvaluator implements PolicyEvaluator {   @Override public void evaluate(ResourcePermission permission, AuthorizationProvider authorizationProvider, EvaluationContext executionContext, Decision decision, Map<Policy, Map<Object, Decision.Effect>> decisionCache) { - StoreFactory storeFactory = authorizationProvider.getStoreFactory(); - PolicyStore policyStore = storeFactory.getPolicyStore(); - ResourceStore resourceStore = storeFactory.getResourceStore(); -  ResourceServer resourceServer = permission.getResourceServer(); PolicyEnforcementMode enforcementMode = resourceServer.getPolicyEnforcementMode();  @@ -79,6 +75,9 @@ public void evaluate(ResourcePermission permission, AuthorizationProvider author }   if (PolicyEnforcementMode.PERMISSIVE.equals(enforcementMode)) { + if (resource != null && resource.isOwnerManagedAccess()) { + return; + }  grantAndComplete(permission, authorizationProvider, executionContext, decision); } }

Mitigation Strategies

  • Upgrade Keycloak or Red Hat build of Keycloak to a patched version that skips owner-managed resources during permissive fallback evaluation.
  • Enforce the default ENFORCING policy enforcement mode on all resource servers utilizing User-Managed Access (UMA).
  • Define explicit type-level authorization policies when PERMISSIVE policy enforcement mode cannot be disabled.

Remediation Steps:

  1. Upgrade upstream Keycloak deployments to version 26.4.13 or 26.6.4 or later.
  2. Upgrade Red Hat build of Keycloak 26.4 deployments to version 26.4.13-1 (errata RHSA-2026:30083 / RHSA-2026:30084).
  3. Upgrade Red Hat build of Keycloak 26.6 deployments to version 26.6.4-2 (errata RHSA-2026:30049 / RHSA-2026:30050).
  4. If immediate patching is not feasible, navigate to Clients -> -> Authorization -> Settings in the Keycloak Admin Console and set Policy Enforcement Mode to ENFORCING.

References

Read the full report for CVE-2026-9799 on our website for more details including interactive diagrams and full exploit analysis.