PT-2026-46851 · Maven · Org.Keycloak:Keycloak-Services

Publicado 2026-05-19 · Atualizado 2026-05-19

OSV

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A flaw was found in Keycloak. When both realm-level and client-level notBefore revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

Correção

Enumeração de Fraquezas

CWE-303

Identificadores relacionados

GHSA-83C4-FFJP-MXP9

Produtos afetados

Org.Keycloak:Keycloak-Services

Referências · 9

• https://github.com/keycloak/keycloak/issues/49118 · Nota
• https://github.com/keycloak/keycloak/commit/b6cd645683f469724cd588fac415fe09bd20a27a · Nota
• https://github.com/keycloak/keycloak/commit/c5bda802e98b412e42fa62ff6240669e9ea4a858 · Nota
• https://github.com/keycloak/keycloak/pull/49129 · Nota
• https://github.com/keycloak/keycloak · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2479586 · Nota
• https://osv.dev/vulnerability/GHSA-83c4-ffjp-mxp9 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-8922 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-8922 · Nota de Segurança