This vulnerability in Red Hat Build of Keycloak stems from improper string prefix comparison during group path validation in the authorization services. When the 'extendChildren' policy is enabled, the system incorrectly authorizes users based on a prefix match of group names rather than exact membership. This flaw allows users from sibling groups with similar name prefixes to gain unauthorized integrity-impacting permissions within the realm, including administrative functions or access to protected resources. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) and requires low privileges and no user interaction for exploitation. Red Hat has assessed the impact as moderate and currently does not provide a patch or effective mitigation.

Successful exploitation allows an attacker to bypass intended access restrictions and gain unauthorized integrity-impacting permissions, such as administrative access or modification of protected data within the Keycloak realm. The flaw does not impact confidentiality or availability directly but can lead to unauthorized modification of application data and access control bypass. Exploitation requires a specific group naming collision and the 'extendChildren' policy setting to be active.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory page for updates on patches or mitigations. Until a fix is released, organizations should carefully review group naming conventions and the use of the 'extendChildren' policy setting to minimize risk, though no official workaround is provided.