# CVE-2026-9802: Keycloak refresh token replay via session revocation bypass

Source: https://junglewise.ai/threats/cve-2026-9802-keycloak-refresh-token-replay-via-session-revocation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-9802 · Severity: medium · CVSS 6.8 · Published 2026-05-28

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A flaw in how the system handles session security means that if the server restarts, an attacker who has previously stolen a user's login token could reuse it to gain unauthorized access to that user's account. This could allow the attacker to view sensitive personal information or perform actions on behalf of the victim even if the original session was supposed to be revoked.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak), [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-9802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9802 being exploited in the wild.

**How severe is CVE-2026-9802?** Medium severity, with a CVSS score of 6.8, published 28 May 2026.

**Which products and versions are affected?** Keycloak <= 26.4.7, >= 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,last_affected=26.4.7; Red Hat build of Keycloak 26.4, 26.6.

**Is there a fix for CVE-2026-9802?** A patch was published on 2026-06-10: Red Hat released patched versions in RHSA-2026:25098 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9802 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9802?** Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An insufficient session expiration vulnerability (CWE-613) exists in Keycloak's 'keycloak-services' component. When the 'revokeRefreshToken=true' setting is enabled alongside persistent session storage, a server or cluster restart can cause internal timing mechanisms to reset. This allows a remote attacker who has intercepted a victim's refresh token to successfully replay it, bypassing revocation checks. The attack requires the attacker to have already captured a valid token and for a restart event to occur, leading to unauthorized account access and potential privilege escalation. The issue is addressed in Keycloak version 26.6.3.

## Affected products

- Keycloak Keycloak <= 26.4.7, >= 26.5.0, < 26.6.3
- Red Hat Corportation Red Hat build of Keycloak 26.4, 26.6

## Identifiers

- CVE-2026-9802
- GHSA-v5g5-wwmp-jppw

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-06-10: patched: Red Hat released patched versions in RHSA-2026:25098

## References

- [https://access.redhat.com/security/cve/CVE-2026-9802](https://access.redhat.com/security/cve/CVE-2026-9802)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2482467](https://bugzilla.redhat.com/show_bug.cgi?id=2482467)
- [https://access.redhat.com/errata/RHSA-2026:25098](https://access.redhat.com/errata/RHSA-2026:25098)
- [https://access.redhat.com/errata/RHSA-2026:25097](https://access.redhat.com/errata/RHSA-2026:25097)
- [https://access.redhat.com/errata/RHSA-2026:30049](https://access.redhat.com/errata/RHSA-2026:30049)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)