A flaw in Keycloak’s PathMatcher component causes the system to compare request paths without normalizing the URI. An attacker can append a trailing slash or matrix parameters to a URL, which tricks the system into applying a less restrictive security policy. The result is that an authenticated user can access administrative or restricted areas that they should not be able to see, providing an unauthorized privilege escalation.

The vulnerability affects Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. The CNA identified these products, but specific affected versions are not listed; administrators should verify whether their installations are within the affected range.

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known public exploitation. The attack requires an authenticated session, and the attacker must craft a request with a non‑normalized URI to bypass authorization. Because the flaw is tied to path normalization, exploitation is limited to URLs within the application’s controlled domain.