Executive brief
Keycloak, a tool used to manage user identities and access to applications, has a security flaw in how it handles group-based permissions. When a security policy is set to include sub-groups, the system incorrectly grants access to users in unrelated groups that happen to have similar names. This could allow a regular user to gain unauthorized administrative control or access sensitive resources simply by being a member of a group with a specific name prefix.
Technical details
A vulnerability exists in the org.keycloak.authorization component of Keycloak's group policy evaluation logic. When the 'extendChildren' option is enabled, the system performs a raw string prefix match on group paths (e.g., '/group-sibling' vs '/group') without properly validating path delimiters. An authenticated attacker with low privileges can exploit this by joining a sibling group with a colliding name prefix to bypass authorization checks. This allows the attacker to gain elevated permissions, including administrative functions or protected resources intended only for the target group and its legitimate descendants.
Affected products
- Red Hat Build of Keycloak All versions using keycloak-services
Timeline
- 2026-07-29: disclosed: Reported to Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date