CVE-2026-19608

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the group policy provider of Keycloak authorization services used for fine-grained access control. The issue arises during the evaluation of group-based policies when tokens contain only group names instead of full paths. In organizations where two different groups share the same name, the system may misidentify a user from an unauthorized group as a member of an authorized group, potentially granting unauthorized access to protected resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.