CVE-2026-18203

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check to verify group membership. This logic error allows a user belonging to a different group with a similar starting name to bypass security checks, potentially granting unauthorized access to protected resources or administrative functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.