CVE-2026-19608: Red Hat Build Of Keycloak

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

Affected products

• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Single Sign-On 7

Published 2026-08-18. Last modified 2026-08-18.