Log in Start free

Vulnerability · Published May 19, 2026 · Assigned by redhat

CVE-2026-8922Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Medium 5.4

In plain English

A medium-severity security flaw in Red Hat build of Keycloak 26.4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 79.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-servicesno fix listedGHSA-83c4-ffjp-mxp9

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4.13 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6 see references
Red Hat Red Hat build of Keycloak 26.6.3 see references

Weakness: CWE-303 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References