Unauthorized scopes via cross-owner resource name collision

Missing authorization in Red Hat build of Keycloak allows remote authenticated users to obtain unauthorized UMA resource scopes. The authorization token endpoint resolves permission tickets by resource name without isolating the owning user, then merges scopes from matching names. Exploitation requires low-privilege access, a colliding resource name, and prior victim interaction; the resulting token grants unintended scopes on the victim's resource.