EUVD-2026-51478
GHSA-vhxw-j6h3-48jm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the mandatory pre-existing realm revocation policy prerequisite; PR:L because a valid token is required; no availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AnalysisAI
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Technical ContextAI
Keycloak implements token lifecycle management through 'not-before' policies, which invalidate tokens issued before a designated timestamp. These policies exist at two scopes: the security realm (global) and individual clients (applications). The TokenManager component is responsible for enforcing revocation during token refresh and userinfo requests. CWE-862 (Missing Authorization) manifests here as a missing or incorrectly ordered comparison between the realm-level and client-level policy timestamps - when the realm policy is older but non-zero, the client-level revocation check is bypassed entirely rather than taking the stricter of the two values. CPE data confirms affected products include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss Enterprise Application Platform Expansion Pack, all of which incorporate Keycloak's token management subsystem.
RemediationAI
Administrators should apply vendor-released patches for Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and the affected JBoss EAP Expansion Pack components; exact patched versions are not specified in the available data and must be confirmed via the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-18218 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2508313. As a compensating control prior to patching, administrators can update the realm-level 'not-before' policy to a current timestamp whenever issuing a client-level revocation - this ensures the realm policy timestamp is newer than the client revocation, preventing the silent bypass. The trade-off is that updating the realm-level policy causes mass token invalidation across all clients in the realm, forcing all users to re-authenticate, not just those of the targeted application. For high-sensitivity revocation scenarios, temporarily elevating the realm 'not-before' timestamp immediately before and after issuing a client revocation provides a narrow window of correct enforcement.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today