VULNERABILITY INTELLIGENCE

CVE-2026-18207

CVSS score6.5 MEDIUM
EPSS probability0.31%
CISA KEVNot currently listed
Published2026-07-29
Last modified2026-08-11
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

Weakness classification

  • secalert@redhat.com: CWE-285

Primary references