Group Policy Bypass in Keycloak via Group Name Collision

Executive Summary

This vulnerability is in Keycloak's group policy provider, which controls access to resources. It occurs when group-based policies are evaluated using tokens that only include group names without full paths. If two groups in different parts of an organization share the same name, a user in the unauthorized group may be mistakenly granted access to protected resources meant for the authorized group.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Keycloak group policy configurations and token claims. Check if OIDC group mappers emit only group names without full paths. Verify group name collisions across different paths in your directory service. Review access logs for unauthorized access attempts to protected resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to gain access to sensitive data or functionality they should not be able to reach. This happens if group names collide across different paths and the system relies on group names alone for access control.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating Keycloak to the latest version or applying patches provided by Red Hat. Ensure OIDC group mappers include full group paths in tokens. Avoid group name collisions by renaming conflicting groups. Monitor access logs for suspicious activity and restrict permissions temporarily.

Useful 0 Not Useful 0