CVE-2026-0976
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Jan 15, 2026
CISA due date
—
The record
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-server | 0 | No fix |
Related vulnerabilities
- GHSA-v897-pv23-r8cw Keycloak has an improper input validation vulnerability Same vulnerability
- GHSA-gv3v-2cpp-3pmq Keycloak logs sensitive headers Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-11537 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-11538 A vulnerability exists in Keycloak's server distribution where enabling debug mode… Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-10939 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20