An incomplete fix for CVE-2026-9689 was identified in Keycloak's RedirectUtils.containsForbiddenOidcParameters() method. While the original fix successfully blocks forbidden OIDC parameters (such as code, state, and iss) in the URI query string, it fails to inspect the URI fragment (#).
When a client is configured with a wildcard redirect URI, an attacker can supply a redirect_uri containing these forbidden parameters within the fragment. Because matchesRedirects strips fragments during prefix matching, the crafted URI is accepted. During the authorization response, Keycloak appends its own parameters to the attacker-supplied fragment, leading to a polluted response where attacker-controlled values appear first.
Exploitation Conditions:
The target client must have a wildcard-registered redirect URI (e.g., https://app.example.com/*).

The attacker must induce a victim to follow a crafted authorization URL.

The relying party (client application) must use a first-wins parsing strategy for duplicate parameters.


Concrete Impact:
Injection of attacker-controlled iss (issuer), state, and access_token parameters.

Potential for session fixation or account confusion if the relying party does not validate parameters per RFC 9207.