CVE-2026-19608: Keycloak Authorization Bypass Vulnerability

CVE-2026-19608 Overview

CVE-2026-19608 is an authorization flaw in the group policy provider of Keycloak authorization services. Keycloak evaluates group-based policies using tokens that contain only group names rather than full hierarchical paths. When two groups in different parts of an organization share the same name, the evaluator cannot distinguish between them. A user in an unauthorized group with a colliding name can be mistaken for a member of the authorized group. This grants access to protected resources the user should not reach. The weakness is classified under CWE-285: Improper Authorization.

Critical Impact
Users in groups sharing a name with an authorized group can gain unauthorized access to protected resources managed by Keycloak fine-grained authorization services.

Affected Products

Red Hat Keycloak authorization services (group policy provider)
Deployments relying on group-name-only tokens for fine-grained access control
Environments with duplicate group names across organizational subtrees

Discovery Timeline

2026-08-18 - CVE-2026-19608 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-19608

Vulnerability Analysis

Keycloak provides fine-grained authorization services that let administrators define group-based policies. These policies decide whether a user, based on group membership, may access a protected resource. The group policy provider compares group claims in the access token against the groups configured in the policy.

The defect appears in how the provider matches those claims. When the token contains only the group name and not the full group path, the provider treats groups with identical names as equivalent. Keycloak supports nested and organizationally scoped groups, so two subtrees can legitimately hold groups named developers, admins, or finance. The evaluator collapses these distinct groups into a single identity for the policy decision.

A user assigned to /EngineeringOrg/developers is treated as a member of /PartnerOrg/developers if the policy references the latter. The authorization decision returns allow, and the request proceeds against a resource the user should not access.

Root Cause

The root cause is inadequate identifier resolution in the group policy provider. Group names are not unique across a Keycloak realm, but the provider uses the name as the comparison key when the token lacks path data. The correct comparison requires the full group path or the immutable group identifier.

Attack Vector

An authenticated user in an unauthorized group with a colliding name requests a resource protected by a group policy. Keycloak issues a token containing the group name claim. The group policy provider matches the name against the authorized group and returns an allow decision. Exploitation requires low privileges and network access, and does not require user interaction. The attack complexity is high because it depends on the presence of duplicate group names across the realm.

See the Red Hat CVE-2026-19608 advisory and Red Hat Bug Report #2514530 for vendor technical details.

Detection Methods for CVE-2026-19608

Indicators of Compromise

Keycloak audit log entries showing successful resource access by users whose group memberships do not include the authorized group path
Repeated authorization grants to users from unrelated organizational subtrees for the same protected resource
Group claims in issued tokens that contain only names without full paths

Detection Strategies

Review Keycloak realm configuration for duplicate group names across different parent groups or organizations
Correlate token issuance events with resource access decisions to identify users granted access despite lacking the authorized group path
Enable and inspect Keycloak event listeners for CODE_TO_TOKEN and PERMISSION_TOKEN events referencing group-based policies

Monitoring Recommendations

Forward Keycloak server and audit logs to a centralized SIEM for continuous review of authorization decisions
Alert on access grants where the token subject belongs to a group path different from the policy-defined group path
Track configuration changes to group policies and group hierarchies within the realm

How to Mitigate CVE-2026-19608

Immediate Actions Required

Apply the Keycloak security update referenced in the Red Hat advisory for CVE-2026-19608 when available
Audit group hierarchies in each realm and rename or consolidate groups that share names across different parent paths
Review resource permissions that rely on group policies and validate that policy decisions require full path matching

Patch Information

Red Hat tracks the fix under Bug Report #2514530. Consult the vendor advisory for fixed package versions and errata identifiers applicable to your deployment.

Workarounds

Configure Keycloak group mappers to include the full group path in issued tokens rather than the group name alone
Replace group-based policies with role-based or client-scope policies where feasible, since roles are realm-unique
Enforce unique group names across the realm as an interim administrative control until the patch is applied

bash

# Configuration example: enforce full group path claims in the group mapper
# Set the Full group path option on the Group Membership mapper for each client
# via the Keycloak admin CLI (kcadm.sh)

kcadm.sh create clients/<client-uuid>/protocol-mappers/models \
  -r <realm> \
  -s name=groups \
  -s protocol=openid-connect \
  -s protocolMapper=oidc-group-membership-mapper \
  -s 'config."full.path"=true' \
  -s 'config."id.token.claim"=true' \
  -s 'config."access.token.claim"=true' \
  -s 'config."claim.name"=groups'