Security Brief: Keycloak CVE-2026-9689 HTTP Parameter Pollution Flaw in OIDC Redirect URIs

CVE-2026-9689 is a medium-severity Keycloak vulnerability involving HTTP parameter pollution in OIDC redirect URI handling, potentially allowing attacker-controlled parameters to influence authentication flows.

Back to Blog

Illustration of Keycloak vulnerability CVE-2026-9689 related to HTTP parameter pollution.

What happened

CVE-2026-9689 is an HTTP parameter pollution vulnerability affecting Keycloak, the open-source identity and access management platform. The flaw relates to OpenID Connect (OIDC) redirect URI handling and can allow response parameter duplication when a client accepts overly broad redirect URIs.

An attacker can craft a specially constructed URL containing manipulated parameters. If a user follows the link, the affected client application may prioritize attacker-controlled information over legitimate authentication data. NIST lists CVE-2026-9689 with a CVSS 3.1 score of 4.2, rated Medium. Exploitation requires user interaction and has high attack complexity, but does not require prior privileges.

Why it matters for website owners

Keycloak frequently protects login flows, customer portals, dashboards, APIs, and other sensitive applications. Weak redirect URI restrictions can create opportunities for attackers to interfere with authentication responses and potentially bypass security controls or gain unauthorized access to protected resources.

The Keycloak 26.7.0 release identifies CVE-2026-9689 as a resolved security issue. Community Keycloak users should upgrade to version 26.7.0 or a later supported release. Organizations using Red Hat Build of Keycloak should apply the appropriate vendor-provided security updates for their supported branch.

What to check on your site

  • Identify the Keycloak version currently deployed and confirm whether the relevant security update has been applied.
  • Review OIDC client configurations and replace unnecessarily broad redirect URI patterns with narrowly defined trusted destinations.
  • Use Vulnify's Chain Checker to review unexpected redirect behavior.
  • Check public-facing redirect endpoints with the Redirect Checker.
  • Use the Vulnerability Scanner to assess the wider public-facing attack surface. These checks complement, rather than replace, Keycloak configuration review and patching.

For practical guidance on restricting redirect destinations, see Vulnify's Redirect Prevention Guide. Authentication deployments should also review cookie protections covered in Security Explained.

Sources