GHSA-83c4-ffjp-mxp9 CVE-2026-8922
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
- Severity
- 5.4 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.28%
- Chance of exploitation in the next 30 days. Higher than 20.61% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-303 Incorrect Implementation of Authentication Algorithm
- Fix
- None yet
- No fixed version published
Description
A flaw was found in Keycloak. When both realm-level and client-level notBefore revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-services | <= 26.6.2 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-303: Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
References
Advisories
Packages
Other links
- github.com/keycloak/keycloak/issues/49118
- github.com/keycloak/keycloak/pull/49129
- github.com/keycloak/keycloak/commit/b6cd645683f469724cd588fac415fe09bd20a27a
- github.com/keycloak/keycloak/commit/c5bda802e98b412e42fa62ff6240669e9ea4a858
- access.redhat.com/errata/RHSA-2026:25097
- access.redhat.com/errata/RHSA-2026:25098
- access.redhat.com/errata/RHSA-2026:30049
- access.redhat.com/errata/RHSA-2026:30050
- access.redhat.com/security/cve/CVE-2026-8922
- bugzilla.redhat.com/show_bug.cgi
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v3f7-2p4r-mwfw Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass | High | Also affects org.keycloak:keycloak-services |
| GHSA-9jrw-8xf7-xqhq Keycloak vulnerable to information disclosure through arbitrary filesystem path probing | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-f5p5-6xmx-p252 Keycloak vulnerable to authorization bypass via incorrect uri comparison | High | Also affects org.keycloak:keycloak-services |
| GHSA-r7rc-c989-86g6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass | Critical | Also affects org.keycloak:keycloak-services |
| GHSA-6g26-7cx5-mrrg Keycloak: Information disclosure due to user profile permission bypass | Low | Also affects org.keycloak:keycloak-services |
| GHSA-cpf7-j4cf-vqx4 Keycloak has an Out-of-bounds Read | Medium | Also affects org.keycloak:keycloak-services |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor