This vulnerability in Red Hat Build of Keycloak's group policy provider occurs because the system falls back to matching bare group names when full path information is missing from token claims. If two groups in different organizational paths share the same name, a user in an unauthorized group may be mistaken for a member of an authorized group, allowing unauthorized access to resources protected by group-based policies. Exploitation requires specific conditions: OIDC group mappers must emit name-only claims and group name collisions must exist. The Red Hat Product Security team rates this vulnerability as moderate severity with a CVSS 3.1 base score of 5.3. No patch or effective mitigation is currently available that meets Red Hat's standards for ease of use, applicability, and stability.

Successful exploitation allows an attacker with low privileges to gain unauthorized access to protected resources by satisfying group-based policies they are not intended to meet. The vulnerability impacts integrity by enabling modification of application data or files through unauthorized access. Confidentiality and availability impacts are not present. Exploitation complexity is high, requiring specific configuration and group name collisions.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since no official fix exists, consider reviewing group naming conventions to avoid collisions and carefully configuring OIDC group mappers to include full path information if possible.