A vulnerability in the group policy provider of Keycloak authorization services allows improper evaluation of group-based policies when tokens contain only group names without full paths. This can cause users belonging to unauthorized groups with the same name as authorized groups to gain access to protected resources. The flaw affects fine-grained access control mechanisms in Keycloak.