Red Hat Keycloak CVE-2026-8922

Exploitation requires that the targeted Keycloak realm has BOTH a realm-level notBefore revocation policy configured (set to a non-zero timestamp) AND at least one client within that realm also has a client-level notBefore policy configured simultaneously. This dual-policy configuration is the specific triggering condition; environments where only realm-level or only client-level notBefore policies are set are not affected by this bypass. The CVSS vector (PR:L) confirms the attacker must possess a currently-issued, but supposedly realm-revoked, access token - meaning exploitation requires a token obtained through prior authentication, not anonymous access. Exploitation is further constrained to the OIDC introspection flow specifically; other token validation paths (e.g., local JWT signature verification without introspection) are not confirmed to be affected by this flaw. Limiting factors include: the requirement for an authenticated session token, the need for the specific dual-policy configuration to be active, and the dependency on resource servers using the introspection endpoint rather than offline JWT validation.

The CVSS 3.1 base score of 5.4 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring low privileges (PR:L) with no user interaction and unchanged scope, yielding low confidentiality and integrity impact. The PR:L vector confirms an authenticated attacker is required - exploitation is not possible by anonymous users. There is no EPSS score provided in the available data, no CISA KEV listing, and no publicly known proof-of-concept code, which collectively suggest this has not been observed in mass exploitation. However, the real-world severity can exceed the raw score in specific deployment contexts: organizations that use Keycloak's notBefore revocation as a primary incident response mechanism (e.g., compromised credential revocation or forced re-auth during a breach) may find that their revocation actions are silently ineffective. In environments relying on realm-level notBefore for security-critical revocation workflows, the operational risk is materially higher than the 5.4 score implies. No conflicting signals between CVSS and description were identified.

An attacker who holds a valid Keycloak access token - obtained either legitimately or through credential theft - retains active token validity even after a Keycloak administrator issues a realm-level notBefore revocation intended to invalidate all tokens issued before a specific timestamp. Because the introspection endpoint ignores the realm-level policy when a client-level notBefore is also set, any resource server querying the introspection endpoint receives an 'active: true' response and grants continued access. This scenario is most impactful in incident response situations where an organization attempts to perform a broad forced-logout or revoke a compromised user session across all applications simultaneously. No public proof-of-concept code has been identified at time of analysis.