Description

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T11:16:50.403Z",
  "pubdate": "2026-08-18T11:16:50.403Z",
  "executiveSummary": "A logical flaw exists in the group policy provider of Keycloak authorization services, specifically within the subsystem responsible for managing fine-grained access control to protected resources.\nThe vulnerability arises during the evaluation of group-based access control policies when processing security tokens that supply only group names rather than fully qualified hierarchical group paths.\nThis ambiguity allows a malicious actor belonging to an unauthorized organizational group to bypass security constraints if their group shares a name with an authorized group located elsewhere in the directory hierarchy.\nConsequently, unauthorized users can successfully impersonate members of privileged groups, leading to unauthorized resource access and potential privilege escalation within applications dependent on Keycloak authorization services.\nExploitation requires the attacker to possess a valid authentication token and target environments where hierarchical group disambiguation is disabled or unsupported by the issued tokens.",
  "technicalDetails": "The vulnerability resides within the group policy provider component of Keycloak authorization services, which evaluates user group membership against defined resource protection policies.\nThe root cause stems from insufficient validation and disambiguation logic when processing group identifiers within security tokens. Specifically, the policy evaluation engine assesses group membership based solely on relative group names rather than canonical, fully qualified group paths.\nIn organizational structures where multiple disparate branches contain subgroups sharing identical naming conventions (e.g., /Engineering/Developers versus /Marketing/Developers), relying exclusively on the leaf group name strips away critical contextual hierarchy.\nStep-by-step attack flow proceeds as follows: First, an authenticated user belonging to an unauthorized group (e.g., Marketing/Developers) acquires a security token containing their group claims, which expose only the group name ('Developers'). Second, the user attempts to access a protected resource restricted by a group policy intended exclusively for an authorized group in a different branch (e.g., Engineering/Developers). Third, the Keycloak group policy provider evaluates the incoming token claims against the policy requirements. Fourth, because the evaluation logic matches solely on the string 'Developers' without verifying the absolute path, the policy engine incorrectly validates the user as a member of the authorized group. Fifth, access to the protected resource is granted, resulting in a authorization bypass.\nThe attack vector is network-exploitable against applications utilizing Keycloak for fine-grained authorization, requiring valid authentication credentials but no specialized administrative privileges beyond standard user access within a colliding group namespace."
}