EUVD-2026-51926
GHSA-mcjq-c4g7-wcfh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AV:N (authorization request sent over network), PR:L (valid realm account required), I:H (time-based authorization controls fully bypassed), C:N and A:N confirmed by no data exposure or service disruption.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
AnalysisAI
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the CVSS High integrity impact accurately reflects that time-gated authorization controls are rendered entirely ineffective against any valid account holder.
Technical ContextAI
Keycloak is an open-source Identity and Access Management platform supporting OAuth 2.0, OpenID Connect, and User-Managed Access (UMA). Its Authorization Services module allows administrators to define fine-grained resource permissions, including time-based policies that restrict access to defined windows (e.g., 09:00-17:00 on weekdays). The root cause is CWE-863 (Incorrect Authorization): the authorization evaluation path trusts a time parameter supplied by the requesting client rather than exclusively relying on the server's authoritative clock, violating the principle that security-sensitive policy inputs must come from trusted sources only. Affected CPEs include cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, all with wildcard versioning indicating broad version coverage.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18572 for patched package versions and apply updates to Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack as available - exact patched version numbers were not confirmed from available data, so treat vendor advisory as the authoritative source. Where immediate patching is not possible, the most effective compensating control is to supplement or replace Keycloak time-based policies with network-layer or reverse-proxy time restrictions (e.g., firewall rules or WAF policies blocking requests to time-restricted endpoints outside permitted hours), since these cannot be overridden by client-supplied parameters - note this may require infrastructure changes with operational overhead. Alternatively, administrators may remove time-based policies and implement equivalent controls at the application layer, though this eliminates the Keycloak-native enforcement entirely. Deploy monitoring on Keycloak authorization audit logs to detect off-hours access to time-gated resources as a detection measure.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today