EUVD-2026-51926
GHSA-mcjq-c4g7-wcfh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AV:N (authorization request sent over network), PR:L (valid realm account required), I:H (time-based authorization controls fully bypassed), C:N and A:N confirmed by no data exposure or service disruption.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
AnalysisAI
Time-based authorization policy bypass in Red Hat Build of Keycloak permits any low-privileged authenticated user to inject a fabricated timestamp into their authorization request, causing Keycloak's Authorization Services engine to evaluate the forged value instead of the actual server clock. This fully defeats time-based access controls - such as business-hours restrictions - across affected Red Hat products including Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP Expansion Pack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Keycloak user account in the target realm (CVSS PR:L confirms authentication is required - unauthenticated external attackers cannot exploit this). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (score 6.5, Medium) is well-calibrated: network-accessible, low complexity, no user interaction, but requiring a valid low-privileged account (PR:L), which is the principal limiting factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Keycloak user with a low-privileged account constructs an authorization request targeting a time-restricted resource and embeds a forged timestamp set to a value within the policy-allowed window (e.g., 10:00 AM on a weekday), submitting it at 2:00 AM on a weekend. Keycloak's authorization engine evaluates the time-based policy against the attacker-controlled timestamp rather than the server clock, grants the permission, and issues a valid token. … |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18572 for patched package versions and apply updates to Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack as available - exact patched version numbers were not confirmed from available data, so treat vendor advisory as the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today