6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9792

CVE-2026-9792: Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

A flaw was found in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9792

CVE-2026-9792:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	>= 26.5.0, < 26.6.3	26.6.3
org.keycloak:keycloak-services	maven	<= 26.4.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within Keycloak's client policies framework, where several condition providers failed to properly evaluate policies for Resource Owner Password Credentials (ROPC) grants. The applyPolicy methods in ClientAttributesCondition, ClientRolesCondition, ClientProtocolCondition, ClientAccessTypeCondition, and ClientScopesCondition did not handle the RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST event. This oversight caused these conditions to abstain from voting on the policy. When all of a policy's conditions abstain, the policy is not enforced. As a result, executors tied to that policy, such as reject-ropc-grant, were silently bypassed. This flaw could be exploited by an unauthenticated attacker to obtain tokens using the ROPC grant type, even when a policy was explicitly configured to prohibit it. The patches rectify this by ensuring the applyPolicy methods correctly process the ROPC grant event, thus enforcing the intended security policies.

Vulnerable functions

org.keycloak.services.clientpolicy.condition.ClientAttributesCondition.applyPolicy

services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientAttributesCondition.java

The 'applyPolicy' method in ClientAttributesCondition used a switch statement that did not include a case for 'RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST'. This caused the condition to abstain from voting during an ROPC grant, allowing the client policy (including the 'reject-ropc-grant' executor) to be bypassed.

org.keycloak.services.clientpolicy.condition.ClientRolesCondition.applyPolicy

services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientRolesCondition.java

The 'applyPolicy' method in ClientRolesCondition used a switch statement that did not include a case for 'RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST'. This caused the condition to abstain from voting during an ROPC grant, allowing the client policy (including the 'reject-ropc-grant' executor) to be bypassed.

org.keycloak.services.clientpolicy.condition.ClientProtocolCondition.applyPolicy

services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientProtocolCondition.java

The 'applyPolicy' method in ClientProtocolCondition used a switch statement that did not include a case for 'RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST'. This caused the condition to abstain from voting during an ROPC grant, allowing the client policy (including the 'reject-ropc-grant' executor) to be bypassed.

org.keycloak.services.clientpolicy.condition.ClientAccessTypeCondition.applyPolicy

services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientAccessTypeCondition.java

The 'applyPolicy' method in ClientAccessTypeCondition was missing a case for 'RESOURCE_OWNER_PASSWORD_CREDENTIALS_REQUEST' in its switch statement. This omission meant the condition would not be evaluated for ROPC grants, leading to a bypass of the associated client policy.

org.keycloak.services.clientpolicy.condition.ClientScopesCondition.applyPolicy

services/src/main/java/org/keycloak/services/clientpolicy/condition/ClientScopesCondition.java

Based on the vulnerability description and test modifications in the patch, the 'applyPolicy' method in ClientScopesCondition likely failed to evaluate policies during an ROPC grant. This would cause the condition to abstain, allowing the 'reject-ropc-grant' executor to be bypassed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.