EUVD-2026-83600
GHSA-82wc-7jr6-wxgm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Network refresh endpoint (AV:N) but needs an existing refresh token (PR:L) plus a disabled-client/offline-validation condition (AC:H); limited confidentiality/integrity from continued token access, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.
AnalysisAI
Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already hold a valid, unexpired refresh token for a client (PR:L), and the specific target audience client must have been administratively disabled AFTER the refresh token was issued - this is the core precondition that makes the flaw meaningful. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the supplied intelligence, so the first step is to track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93999 and the Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2537165 for the exact fixed Red Hat Build of Keycloak / Red Hat Single Sign-On 7 build and upgrade as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today