Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services
Published May 19, 2026
5.4
MEDIUMCVSS 3.1
EPSS 0.32%
Description
A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.
Affected products
No data.
- n/a
No data.
Red Hat build of Keycloak 26.4
rhbk/keycloak-operator-bundle:26.4.13-1
Fixed · RHSA-2026:30050
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9-operator:26.4-19
Fixed · RHSA-2026:30050
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9:26.4-19
Fixed · RHSA-2026:30050
Red Hat build of Keycloak 26.4.13
rhbk/keycloak-rhel9-operator
Fixed · RHSA-2026:30049
Red Hat build of Keycloak 26.6
rhbk/keycloak-operator-bundle:26.6.3-3
Fixed · RHSA-2026:25097
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9-operator:26.6-6
Fixed · RHSA-2026:25097
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9:26.6-6
Fixed · RHSA-2026:25097
Red Hat build of Keycloak 26.6.3
rhbk/keycloak-rhel9-operator
Fixed · RHSA-2026:25098
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-operator-bundle:26.4.13-1 | Fixed | RHSA-2026:30050 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9-operator:26.4-19 | Fixed | RHSA-2026:30050 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9:26.4-19 | Fixed | RHSA-2026:30050 |
| Red Hat build of Keycloak 26.4.13 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:30049 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle:26.6.3-3 | Fixed | RHSA-2026:25097 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9-operator:26.6-6 | Fixed | RHSA-2026:25097 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9:26.6-6 | Fixed | RHSA-2026:25097 |
| Red Hat build of Keycloak 26.6.3 | rhbk/keycloak-rhel9-operator | Fixed | RHSA-2026:25098 |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Red Hat statement
This Moderate impact flaw in Red Hat Build of Keycloak allows revoked OpenID Connect (OIDC) tokens to remain active due to a failure in honoring realm-level revocation policies when client-level `notBefore` values are also configured. This occurs because the client-level setting can interfere with the intended realm-level revocation, leading to a temporary bypass of security controls.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed May 19, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
May–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.32% (0.00315) | 22.22th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.25% (0.00250) | 16.06th | v5 (v2026.06.15) |
| May 19, 2026 | 0.01% (0.00010) | 1.14th | v4 (v2025.03.14) |
References (13)
- https://access.redhat.com/errata/RHSA-2026:25097 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25098 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30049 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30050 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-8922 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2479586 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://github.com/advisories/GHSA-83c4-ffjp-mxp9 Advisory
- https://github.com/keycloak/keycloak/commit/b6cd645683f469724cd588fac415fe09bd20a27a
- https://github.com/keycloak/keycloak/commit/c5bda802e98b412e42fa62ff6240669e9ea4a858
- https://github.com/keycloak/keycloak/issues/49118
- https://github.com/keycloak/keycloak/pull/49129
- https://nvd.nist.gov/vuln/detail/CVE-2026-8922
- https://www.cve.org/CVERecord?id=CVE-2026-8922
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:25097 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:25098 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:30049 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:30050 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/security/cve/CVE-2026-8922 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2479586 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://github.com/advisories/GHSA-83c4-ffjp-mxp9 | Advisory | |
| https://github.com/keycloak/keycloak/commit/b6cd645683f469724cd588fac415fe09bd20a27a | ||
| https://github.com/keycloak/keycloak/commit/c5bda802e98b412e42fa62ff6240669e9ea4a858 | ||
| https://github.com/keycloak/keycloak/issues/49118 | ||
| https://github.com/keycloak/keycloak/pull/49129 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2026-8922 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-8922 |
Change history (0)
No recorded changes yet.