CVE-2026-9792

The record

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can lead to unauthorized access and information disclosure.

Affected packages

Related vulnerabilities

• CVE-2026-21099 Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local… CWE-280
• CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner… CWE-280
• CVE-2026-73239 Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple… CWE-280
• CVE-2026-18860 Velociraptor allows multi-tenant deployments named "Orgs". CWE-280
• CVE-2026-45195 Kernel software installed and running inside a Host VM may post improper commands to the… CWE-280
• CVE-2026-41566 Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache… CWE-280
• CVE-2026-40371 Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365… CWE-280
• CVE-2026-11764 When creating an export of all reusable media, the secrets of connected gift cards were… CWE-280