PT-2026-41841 · Red Hat · Keycloak

Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-8922

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the OpenID Connect (OIDC) Introspection feature occurs when both realm-level and client-level notBefore revocation policies are configured. In this scenario, the system fails to properly honor the realm-level policy, allowing tokens that should have been revoked to remain active. This can lead to unauthorized access or continued session validity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2026-8922

Affected Products

Keycloak

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8922 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-8922 · Note
• https://twitter.com/CVEnew/status/2056670083066548721 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2479586 · Note