CVE-2026-8922

MEDIUM

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Title source: cna

Description

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

References (2)

Core 2

Core References

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-8922

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2479586

https://bugzilla.redhat.com/show_bug.cgi?id=2479586

Scores

CVSS v3 5.4

EPSS 0.0001

EPSS Percentile 1.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-303

Status published

Products (1)

Red Hat/Red Hat Build of Keycloak

Published May 19, 2026

Tracked Since May 19, 2026