4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9689

CVE-2026-9689: Keycloak Services has Improper Validation of Consistency within Input

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9689

CVE-2026-9689:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	>= 26.5.0, <= 26.6.4
org.keycloak:keycloak-services	maven	<= 26.4.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an HTTP Parameter Pollution issue in Keycloak's handling of the redirect_uri parameter. The core of the issue lies in the org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri function. This function is tasked with ensuring that the redirect_uri provided in an authentication request is valid and matches the client's configuration. However, before the patch, this function failed to check if the redirect_uri itself already contained query parameters that are reserved for the OIDC/OAuth2 response, such as code, state, session_state, iss, etc.

An attacker could exploit this by crafting an authentication link containing a redirect_uri with a malicious code or state parameter (e.g., &redirect_uri=https://client.app/callback?code=attacker_code). When a victim clicks this link and authenticates, Keycloak would process the login and then redirect back to the client application, adding its own code and state parameters. The final URL would look something like: https://client.app/callback?code=attacker_code&code=real_code&state=real_state. Depending on how the client application's web server and application framework parse the query string, it might prioritize the first code parameter (attacker_code), leading to a security bypass.

The patch addresses this by introducing a check within verifyRedirectUri. It now maintains a blocklist of forbidden OIDC parameters and rejects any redirect_uri that contains them in its query string. The analysis of the commit patches clearly shows the addition of the containsForbiddenOidcParameters check within the verifyRedirectUri function, confirming it as the location of the vulnerability.

Vulnerable functions

org.keycloak.protocol.oidc.utils.RedirectUtils.verifyRedirectUri

services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java

This function validates the redirect URI. Before the patch, it did not check for the presence of OIDC response parameters (e.g., 'code', 'state') in the redirect URI's query string. This allowed an attacker to inject their own parameters, leading to HTTP Parameter Pollution. The patch adds a check to reject any redirect URI that contains these forbidden parameters.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.