CVE-2026-8922

MEDIUM

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Title source: cna
STIX 2.1

Description

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:25097
https://access.redhat.com/errata/RHSA-2026:25097
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:25098
https://access.redhat.com/errata/RHSA-2026:25098
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2479586
https://bugzilla.redhat.com/show_bug.cgi?id=2479586
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30049
https://access.redhat.com/errata/RHSA-2026:30049
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30050
https://access.redhat.com/errata/RHSA-2026:30050
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-8922

Scores

CVSS v3 5.4
EPSS 0.0028
EPSS Percentile 20.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-303
Status published
Products (12)
org.keycloak/keycloak-services 0 - 26.6.2Maven
Red Hat/Red Hat Build of Keycloak
Red Hat/Red Hat build of Keycloak 26.4 26.4-19
Red Hat/Red Hat build of Keycloak 26.4 26.4.13-1
Red Hat/Red Hat build of Keycloak 26.4.13
Red Hat/Red Hat build of Keycloak 26.6 26.6-6
Red Hat/Red Hat build of Keycloak 26.6 26.6-8
Red Hat/Red Hat build of Keycloak 26.6 26.6.3-3
Red Hat/Red Hat build of Keycloak 26.6 26.6.4-2
Red Hat/Red Hat build of Keycloak 26.6.3
... and 2 more
Published May 19, 2026
Tracked Since May 19, 2026