CVE-2026-18203

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.6, <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.5, <=1.4.11) +54 more potentially affected by CVE-2026-18203 via org.keycloak:keycloak-authz-policy-common (>=2.0.0.cr1, <=26.7.2)

org.keycloak:keycloak-authz-policy-common MAVEN version =2.0.0.cr1, =1.2.6, =1.2.5, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =24.3.0.0, =24.3.0.0, =2.5.6-24.0, =0.1.0, =8.1, =1.0.0, =1.1.0 and more Source cves: CVE-2026-18203 Source advisory:...