{"id":"CVE-2026-18207","title":"Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching","summary":"A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-285"],"vendor":"Red Hat","product":"keycloak-services","affected":["keycloak-services","rhbk-keycloak-rhel9/rhbk-keycloak-rhel9","rhbk-openshift-rhel9/rhbk-openshift-rhel9","keycloak-services","keycloak-services","keycloak-services"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-29T14:25:17.970291Z"},"published":"2026-07-29","updated":"2026-11-06","sourceUpdated":"2026-11-06T10:25:13.730Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18207","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95761","label":"RHSA-2026:95761"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18207"}],"tags":["cve.org"],"epss":0.00314,"epssPercentile":0.24425,"ingestedAt":"2026-11-06T10:49:35.386Z","slug":"CVE-2026-18207","body":"## Overview\n\nA flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.\n\n## Affected\n\n- `keycloak-services`\n- `rhbk-keycloak-rhel9/rhbk-keycloak-rhel9`\n- `rhbk-openshift-rhel9/rhbk-openshift-rhel9`\n- `keycloak-services`\n- `keycloak-services`\n- `keycloak-services`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}