CVE-2026-19608: Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically affected?
Deployments using Keycloak Authorization Services group-based policies are exposed when policy decisions rely on token group claims containing only names and the organization has duplicate group names in different hierarchy paths. The issue can cause membership in one same-named group to satisfy a policy intended for another.
What does an attacker need to exploit this issue?
An attacker needs a low-privileged account that belongs to a group sharing its name with a group authorized by a path-specific policy. Exploitation also depends on the token containing name-only group claims and on the attacker being able to request the protected resource.
How can I determine whether my environment is affected?
Review group-policy-protected resources for policies intended to distinguish groups by their full hierarchy path, then identify duplicate group names across those paths. Also inspect the group claims placed in tokens used for authorization to determine whether they contain only names rather than full paths.