Authorization Flaw in Keycloak Group Policy Management
CVE-2026-19608

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
18 August 2026

What is CVE-2026-19608?

An issue has been identified in the group policy provider of Keycloak's authorization services, which is critical for managing fine-grained access control to resources. The vulnerability arises when evaluating group-based policies using tokens that only reference group names, ignoring their full paths. This oversight can lead to the misidentification of users, allowing individuals from unauthorized groups to appear as members of authorized ones, thereby granting them access to sensitive resources they should be restricted from reaching.

References

https://access.redhat.com/security/cve/CVE-2026-19608
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514530
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Paul Bottinelli of Trail of Bits in collaboration with OpenAI for reporting this issue.
.