Technical impact
A flaw in Keycloak’s PathMatcher component causes the system to compare request paths without normalizing the URI. This improper string normalization (CWE-178) leads to an authorisation bypass. An attacker can append a trailing slash or matrix parameters to a URL, which tricks the system into applying a less restrictive security policy. The result is that an authenticated user can access administrative or restricted areas that they should not be able to see, providing an unauthorized privilege escalation.
Affected Systems
The vulnerability affects Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. The CNA identified these products, but specific affected versions are not listed; administrators should verify whether their installations are within the affected range.
Risk and Exploitability
The CVSS score of 8.1 indicates a high severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, suggesting no known public exploitation. The attack requires an authenticated session, and the attacker must craft a request with a non‑normalized URI to bypass authorisation. Because the flaw is tied to path normalization, exploitation is limited to URLs within the application’s controlled domain.
