CVE-2026-18207 in Keycloak
Sumário
de MITRE • 29/07/2026
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.
If you want to get best quality of vulnerability data, you may have to visit VulDB.