A flaw in the Keycloak authorization group policy provider allows tokens that contain only group names to be incorrectly matched against policies that expect full group paths. When two distinct groups share the same name, an unauthenticated or unauthorized user can be mistakenly treated as a member of an authorized group, permitting access to resources they should not be able to reach. This weakness is a clear example of improper authorization control (CWE-285).

The vulnerability affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No specific product version is listed, so any deployment using these products could be susceptible unless the group policy provider has been validated to require full group paths.

With a CVSS score of 5.3, the vulnerability is of moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating that widespread exploitation is not documented yet. However, the likely attack vector is remote: an attacker could craft or obtain a token containing only ambiguous group names and use it to gain unauthorized access to protected resources. The risk is mitigated only by preventing the use of ambiguous group names or by fixing the policy evaluation logic, for which no current workaround exists. Users should evaluate the potential impact on their usage of group-based policies.