Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A flaw in how the system handles session security means that if the server restarts, an attacker who has previously stolen a user's login token could reuse it to gain unauthorized access to that user's account. This could allow the attacker to view sensitive personal information or perform actions on behalf of the victim even if the original session was supposed to be revoked.
Technical details
An insufficient session expiration vulnerability (CWE-613) exists in Keycloak's 'keycloak-services' component. When the 'revokeRefreshToken=true' setting is enabled alongside persistent session storage, a server or cluster restart can cause internal timing mechanisms to reset. This allows a remote attacker who has intercepted a victim's refresh token to successfully replay it, bypassing revocation checks. The attack requires the attacker to have already captured a valid token and for a restart event to occur, leading to unauthorized account access and potential privilege escalation. The issue is addressed in Keycloak version 26.6.3.
Affected products
- Keycloak Keycloak <= 26.4.7, >= 26.5.0, < 26.6.3
- Red Hat Corportation Red Hat build of Keycloak 26.4, 26.6
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-06-10: patched: Red Hat released patched versions in RHSA-2026:25098