CVE-2026-19608 in Keycloak
Summary
by MITRE • 08/18/2026
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within Keycloak's authorization services represents a critical flaw in how fine-grained access control policies are evaluated, specifically concerning the handling of group-based permissions. The core technical issue stems from the group policy provider's logic when processing authentication tokens that contain only group names rather than their full hierarchical paths or unique identifiers. In complex organizational structures where groups may be nested or duplicated across different domains within a single Keycloak instance, this simplification leads to ambiguous identity resolution. When the system evaluates whether a user belongs to an authorized group for accessing a specific resource, it performs a string match against the provided name without verifying the full context of that group's location in the directory hierarchy.
This lack of contextual verification creates a significant security gap where two distinct groups sharing the same name but residing in different parts of the organization are treated as identical by the authorization engine. Consequently, if an attacker or unauthorized user belongs to one instance of a named group while access is granted only to another instance with the same name elsewhere in the structure, the system incorrectly grants permission based on the name match alone. This misidentification allows users who should be denied access under strict policy definitions to bypass security controls and reach protected resources intended for other groups. The flaw effectively undermines the principle of least privilege by allowing lateral movement or unauthorized elevation of privileges through simple group naming collisions rather than requiring explicit, unique identity verification.
From a threat modeling perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves an authorization bypass due to insufficient enforcement of access restrictions based on user roles and groups. It also relates closely to CWE-697 Incorrect Comparison during Authorization Checks, where the comparison logic fails to account for all relevant attributes necessary for a definitive decision. In terms of MITRE ATT&CK framework techniques, this flaw facilitates unauthorized resource access which can be categorized under T1078 Valid Accounts if leveraged by an attacker who has compromised credentials within one group but seeks access restricted to another similarly named group. The impact is particularly severe in multi-tenant environments or large enterprises using Keycloak for centralized identity management, where the risk of naming collisions increases with organizational size and complexity.
To mitigate this vulnerability, organizations must ensure they are running a patched version of Keycloak that addresses the token parsing logic in the authorization services. Administrators should also review their group structures to minimize potential name conflicts by implementing unique naming conventions or utilizing full path references where possible within policy definitions. Additionally, enabling detailed audit logging for access control decisions can help detect any anomalous patterns resulting from this flaw before it is exploited. Regular security assessments and penetration testing focused on identity and access management systems are recommended to identify similar logic flaws in custom configurations or extensions that may rely on simplified group matching strategies.