PT-2026-65741 · Red Hat · Red Hat Build Of Keycloak+4
CVE-2026-18207
·
Published
2026-07-29
·
Updated
2026-08-11
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Keycloak (affected versions not specified)
Description
A flaw exists in the client policy enforcement mechanism where the system verifies group membership using names rather than unique identifiers. An attacker possessing client management privileges can bypass security policies by joining a group with a duplicate name located in a different section of the group hierarchy. This could enable the unauthorized registration or update of clients while bypassing mandatory security hardening profiles.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-On 7
Build Of Keycloak