CVE-2026-19608 in Keycloak
Sumário
de MITRE • 18/08/2026
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
If you want to get best quality of vulnerability data, you may have to visit VulDB.