Executive brief
Keycloak is a widely-used identity and access management system that administrators use to enforce time-based access policies—for example, restricting resource access to business hours only. A vulnerability allows attackers to submit forged time values in authorization requests, bypassing these time restrictions and accessing protected resources outside their authorized time windows.
Technical details
The vulnerability is a time-based authorization bypass in Keycloak's policy engine. An attacker can inject or override the server-side time value in an authorization request, causing the time-policy evaluation to use the attacker-controlled timestamp instead of the actual server time. This occurs without authentication bypass; the attacker must have a valid identity but can then circumvent temporal access controls. The fix requires server-side enforcement of the actual server time and rejection of client-supplied time values in policy evaluation.
Affected products
- Red Hat Keycloak
Timeline
- 2026-08-02: disclosed