CVE-2026-18207 is a vulnerability in Keycloak's client policy enforcement mechanism where group membership is checked by name rather than a unique identifier. This flaw allows an attacker with client management privileges to bypass security policies by joining a group with a matching name in a different part of the group hierarchy. Consequently, the attacker could register or update clients without adhering to required security hardening profiles. The vulnerability has a CVSS score of 6.5 (medium severity).