Keycloak 26.7.x Security Policy Bypass Vulnerability (CVE‑2026‑90997) – Immediate Patch Required

A critical vulnerability has been identified in the Keycloak identity and access management platform. The flaw enables attackers to bypass configured security policies, potentially granting them elevated privileges or access to protected resources.

Scope

• Affected versions: Keycloak 26.7.x releases older than 26.7.4.
• Impact: Policy bypass that can lead to unauthorized data access or privilege escalation.
• Tracking IDs: CVE‑2026‑90997, GHSA‑xpwp‑2pcm‑8xq3.

Mitigation

• Upgrade to Keycloak 26.7.4 or later as soon as possible.
• If an upgrade is not immediately feasible, apply the vendor’s patch outlined in the official security bulletin.
• Verify that policy enforcement is functioning correctly after remediation.
• Monitor logs for any anomalous authentication or authorization attempts.

Official Guidance

The French CSIRT (CERT‑FR) published an alert on 17 September 2026 detailing the issue and recommended remediation steps. For the full patch notes and configuration guidance, consult the Keycloak security advisory referenced by the GHSA identifier.

"Immediate action is required to protect systems from potential policy bypass attacks. Users should prioritize updating to the patched release."