Executive brief
Keycloak is an identity management service used to manage user logins and security tokens for applications. A flaw in its token management component prevents administrators from successfully revoking security tokens for specific applications if a broader security policy was previously set for the entire system. This means that even after an administrator attempts to invalidate a user's access, that user may still be able to refresh their session and access sensitive information.
Technical details
A logic error exists in the TokenManager.NotBeforeCheck component of Keycloak. When an administrator sets a 'not-before' revocation policy for a specific client, the system may silently ignore it if the security realm already has an older, non-zero 'not-before' policy in place. This occurs because the logic incorrectly prioritizes the older realm-level timestamp over the newer client-level one. An authenticated attacker with OIDC tokens issued between the two timestamps can continue to refresh sessions, use the introspection endpoint, and access the UserInfo endpoint, effectively bypassing the intended revocation.
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-29: other: Reported to Red Hat Bugzilla
- 2026-07-31: advisory: NVD and Red Hat published advisory details