---
id: CVE-2026-18207
title: >-
  Keycloak-services: keycloak-services: client policy source-group condition
  bypass via duplicate group name matching
summary: >-
  A flaw was found in the client policy enforcement mechanism of Keycloak. The
  issue occurs when the system checks group membership by name instead of a
  unique identifier. An attacker with client management privileges could bypass
  security…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-285
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services
  - rhbk-keycloak-rhel9/rhbk-keycloak-rhel9
  - rhbk-openshift-rhel9/rhbk-openshift-rhel9
  - keycloak-services
  - keycloak-services
  - keycloak-services
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-29T14:25:17.970291Z'
published: '2026-07-29'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:25:13.730Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-18207'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95761'
    label: 'RHSA-2026:95761'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-18207'
tags:
  - cve.org
epss: 0.00314
epssPercentile: 0.24425
ingestedAt: '2026-11-06T10:49:35.386Z'
---

## Overview

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

## Affected

- `keycloak-services`
- `rhbk-keycloak-rhel9/rhbk-keycloak-rhel9`
- `rhbk-openshift-rhel9/rhbk-openshift-rhel9`
- `keycloak-services`
- `keycloak-services`
- `keycloak-services`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.