A flaw was found in the org.keycloak.authorization component of Keycloak. When a group policy is configured with the extendChildren option enabled, the authorization engine performs a raw string prefix match on group paths to determine if a user satisfies the policy requirements. Because the check does not account for path delimiters, a user belonging to a sibling group whose path shares a prefix with the target group (for example, /group-sibling vs /group) is incorrectly granted access. An authenticated attacker with low privileges can exploit this by joining a prefix-colliding sibling group to gain elevated permissions, such as fine-grained admin access or authorization-services rights intended only for the target group and its descendants.