CVE-2026-9689

The record

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.

Affected packages

Related vulnerabilities

• CVE-2026-18238 The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server… CWE-1288
• CVE-2026-18794 The OpenRGB network protocol allows attackers to cause memory exhaustion and… CWE-1288
• CVE-2026-73219 CVAT is an open source interactive video and image annotation tool for computer vision. CWE-1288
• CVE-2026-42982 Improper validation of consistency within input in Windows Secure Kernel Mode allows an… CWE-1288
• CVE-2026-43001 An issue was discovered in OpenStack Keystone before 29.0.2. CWE-1288
• CVE-2026-31431 In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead… CWE-1288
• CVE-2022-50976 A local attacker could cause a full device reset by resetting the device passwords using… CWE-1288
• CVE-2025-10929 Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables CWE-1288