EUVD-2026-60581
GHSA-qxf7-g44v-fgwh
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
AC:H reflects mandatory prerequisite of duplicate group names across hierarchy; PR:L for required authenticated account; I:H for full authorization bypass; no confidentiality or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
AnalysisAI
Keycloak's authorization services group policy provider grants unauthorized access to protected resources by matching group membership using only group names in tokens rather than full hierarchical paths. Authenticated users whose account belongs to a same-named but structurally distinct group can be silently elevated to the permissions of an authorized group, bypassing fine-grained access controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Keycloak authorization services must be configured and actively used to protect at least one resource via a group-based policy; (2) the Keycloak realm must contain two or more groups with identical bare names existing at different locations in the group hierarchy; (3) access tokens issued by the realm must encode group membership by name only rather than by full hierarchical path; and (4) the attacker must hold a valid authenticated account (confirmed by PR:L in the CVSS vector) assigned to the unauthorized same-named group. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score appropriately captures the conditional nature of this vulnerability: while the attack is network-reachable (AV:N) and requires no user interaction (UI:N), the High Attack Complexity (AC:H) reflects the prerequisite that duplicate group names must already exist across different branches of the Keycloak group hierarchy. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched version has been confirmed from the available data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today