A vulnerability in Keycloak's group policy evaluation logic allows unauthorized privilege escalation. The system uses a simple text prefix check when extending permissions to child groups, enabling users in similarly named groups to bypass access controls and gain administrative or protected resource access. This flaw has a medium severity score of 6.5 and affects Keycloak versions prior to the fixed release. Red Hat has issued an important security advisory with a fixed version 26.6.8 addressing this and other vulnerabilities.