EUVD-2026-50214
GHSA-rfxv-6gx8-3fm6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L confirmed because client management privileges are required; I:H because hardening policy bypass enables insecure client registration; no confidentiality or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.
AnalysisAI
Client policy enforcement in Keycloak is bypassable by any user holding client management privileges who exploits a group-name collision across the group hierarchy. Because the policy engine resolves group membership by display name rather than unique identifier, an attacker can create or join a group in a different part of the hierarchy that shares a name with a privileged policy group, then register or update OAuth/OIDC clients without satisfying the required security hardening profiles. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
Keycloak implements client policies - sets of conditions and executor profiles that enforce security constraints (e.g., PKCE, FAPI compliance) on OAuth2/OIDC client registrations and updates. Conditions within those policies can be scoped to group membership. The flaw (CWE-285: Improper Authorization) arises because the group membership condition evaluates membership by group name string rather than the group's internal UUID. In a hierarchical group model, multiple groups at different levels of the tree can share the same leaf name, making name-based resolution ambiguous and exploitable. Affected CPEs include cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*, cpe:2.3:a:red_hat:red_hat_single_sign-on_7:*:*:*:*:*:*:*:*, cpe:2.3:a:red_hat:red_hat_data_grid_8:*:*:*:*:*:*:*:*, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack:*:*:*:*:*:*:*:*, indicating the vulnerability spans the full Red Hat IAM/middleware product family that bundles Keycloak.
RemediationAI
Apply the vendor-released patch from Red Hat once a specific fixed build is published and confirmed via https://access.redhat.com/security/cve/CVE-2026-18207 - exact fix versions are not independently confirmed from available CPE data and should not be assumed. As a compensating control while awaiting the patch, administrators should audit all client policies that use group-membership conditions and verify that no two groups at different hierarchy levels share identical names; renaming ambiguous groups eliminates the name-collision prerequisite. Additionally, restrict client management privileges to the minimum necessary set of realm administrators, reducing the pool of accounts that could trigger this bypass. Be aware that renaming groups may require updating policy conditions and could affect dependent automation. Monitoring the Red Hat Security Advisory portal for updated erratum packages is advised.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today