CVE-2026-18207 Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...

CVE-2025-49012

CVE-2025-49012 (Himmelblau) affects Himmelblau versions 0.9.0–0.9.14 and 1.00-alpha. The issue arises when Entra ID group-based access restrictions use group displayName instead of objectId in pam_allow_groups, allowing a user to create a duplicate-named group, join it, and bypass central-group-b...

sudo -- certain authorized users could run commands as any user

Todd Miller reports: A bug was introduced in Sudo's group matching code in version 1.6.9 when support for matching based on the supplemental group vector was added. This bug may allow certain users listed in the sudoers file to run a command as a different user than their access rule specifies...