https://baslevering.com/tags/authorization/ Recent content in Authorization on Bas Levering Hugo en-us Mon, 29 Jun 2026 00:00:00 +0000 https://baslevering.com/posts/keycloak-policy-enforcer-uri-bypass/ Mon, 29 Jun 2026 00:00:00 +0000 https://baslevering.com/posts/keycloak-policy-enforcer-uri-bypass/ CVE-2026-9800 — Keycloak’s policy enforcer used a substring match to detect its own access-denied page, so any authenticated user could append that path and skip every authorization check. The first package I ever audited, and a .contains() that lets everyone in.