access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-18572 CVE-2026-18572
MEDIUM
Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
Record summary
CVE-2026-18572 has a selected CVSS score of 6.5 (medium).
Description
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
Default status: affected | CVE List | Version data not supplied | |
Red Hat Build of KeycloakBrowse Red Hat / Red Hat Build of Keycloakrhbk-keycloak-rhel9/rhbk-keycloak-rhel9Default status: affected | CVE List | Version data not supplied | |
Red Hat Build of KeycloakBrowse Red Hat / Red Hat Build of Keycloakrhbk-openshift-rhel9/rhbk-openshift-rhel9Default status: affected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform Expansion PackBrowse Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packkeycloak-servicesDefault status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
References
3RHBZ#2509763issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2509763 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18572