EUVD-2026-51484
GHSA-wx5m-whr8-48h5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible IAM service, low complexity once preconditions exist, requires authenticated low-privilege account (PR:L), integrity-only impact with no confidentiality or availability consequence.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources.
AnalysisAI
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Keycloak (CWE-863: Incorrect Authorization) implements group-based policies that can propagate permissions downward to child groups within a hierarchy. The flaw lies in how Keycloak resolves group ancestry during policy evaluation: rather than traversing the actual group hierarchy tree to confirm a true parent-child relationship, it performs a naive string prefix comparison on group path names. This means any group path string that starts with the same character sequence as a privileged group's path will pass the membership check incorrectly. The affected products per CPE data are Red Hat Build of Keycloak (multiple release streams), Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss Enterprise Application Platform Expansion Pack - all of which embed or integrate Keycloak's authorization engine. The vulnerability is classified under CWE-863 because authorization decisions are made on a flawed criterion (string prefix equality) rather than actual group membership, not because credentials are bypassed entirely.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18203 for the authoritative patched version - no specific fixed release version was confirmed in the available source data, so an exact upgrade target cannot be stated here. Until a patched version is applied, organizations should audit all group policies configured with 'extend to child groups' inheritance and verify that no group names in the realm share a common prefix with privileged groups. As a compensating control, rename any groups whose path names could be incorrectly prefix-matched against protected parent groups, eliminating the ambiguity the flawed check exploits; this is disruptive but effective. Alternatively, replace hierarchical child-group policies with explicit per-group permission assignments, trading administrative convenience for correctness. Restricting Keycloak administrative console access to trusted network segments reduces the surface area, but does not prevent exploitation by internally authenticated users. Monitor Bugzilla issue 2508291 for patch availability updates.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today