Executive brief
Keycloak, an identity and access management solution, fails to verify that a client application is still enabled before issuing refresh tokens. An attacker with an existing refresh token can continue obtaining valid access tokens for a disabled client, potentially gaining unauthorized access to protected resources even after administrators have revoked the client's access.
Technical details
The vulnerability exists in the OIDC token refresh process: Keycloak restores audience claims from stored client IDs without validating the client's enabled status, resulting in a missing authorization check (CWE-862). An attacker needs a pre-existing refresh token before the target client is disabled; upon refresh, they can obtain new access tokens for the disabled client to bypass offline JWT validation at resource servers. A fix exists but requires administrative patching.
Affected products
- Red Hat Keycloak
Timeline
- 2026-09-19: disclosed