EUVD-2026-30843
GHSA-83c4-ffjp-mxp9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
DescriptionCVE.org
A flaw was found in Keycloak. When both realm-level and client-level notBefore revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.
AnalysisAI
Token revocation bypass in Red Hat Keycloak's OIDC Introspection endpoint allows low-privileged authenticated users to continue using tokens that should have been invalidated by realm-level notBefore revocation policies. When both realm-level and client-level notBefore policies are simultaneously active, the introspection endpoint incorrectly evaluates only the client-level policy, silently ignoring the realm-wide revocation. This means an administrator's deliberate, broad-scope revocation action - typically used in incident response or forced re-authentication scenarios - is rendered ineffective for any clients that also carry a client-level notBefore setting. No public exploit has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog.
Technical ContextAI
Keycloak implements the OpenID Connect (OIDC) token introspection endpoint (RFC 7662), which resource servers query to validate access tokens. Keycloak's notBefore field is a revocation primitive that marks a timestamp before which all issued tokens for a realm or client are considered invalid - a critical control for forced session invalidation. The affected product (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*) implements a two-level policy hierarchy: realm-level (global, administrator-controlled) and client-level (scoped per application). The root cause is classified as CWE-303: Incorrect Implementation of Authentication Algorithm, meaning the logic that evaluates token validity during introspection fails to properly compose or cascade both policy levels - the realm-level notBefore check is bypassed when a client-level policy is also present, violating the expected security hierarchy where realm policy should take precedence.
RemediationAI
The primary remediation path is to apply the vendor-released patch from Red Hat once available; monitor https://access.redhat.com/security/cve/CVE-2026-8922 for updated advisory status and a fixed build version, as no specific patched version number was confirmed in the available data at time of analysis. As an immediate compensating control, administrators should audit all realms where both a realm-level notBefore policy and one or more client-level notBefore policies are simultaneously configured - this is the precise condition that triggers the bypass. For realms requiring urgent revocation, temporarily removing the client-level notBefore configuration and relying solely on the realm-level policy should restore correct introspection behavior, though this trade-off removes client-scoped revocation granularity. Alternatively, administrators can force token invalidation by rotating client secrets for affected clients, which invalidates existing tokens through a different code path not affected by this flaw. Restricting OIDC introspection endpoint access to trusted internal resource servers via network controls reduces the exposure window but does not eliminate the underlying policy evaluation error.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today