PT-2026-41841 · Red Hat · Keycloak

Joy Gilbert + 1 · CVE-2026-8922 · Published 2026-05-19 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the OpenID Connect (OIDC) Introspection feature occurs when both realm-level and client-level notBefore revocation policies are configured. In this scenario, the system fails to properly honor the realm-level policy, allowing tokens that should have been revoked to remain active. This can lead to unauthorized access or continued session validity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2026-8922

GHSA-83C4-FFJP-MXP9

Affected Products

Keycloak

References · 20

• https://bugzilla.redhat.com/show_bug.cgi?id=2479586 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30049 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-83c4-ffjp-mxp9 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-8922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8922 · Security Note
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30050 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/c5bda802e98b412e42fa62ff6240669e9ea4a858 · Note
• https://github.com/keycloak/keycloak/commit/b6cd645683f469724cd588fac415fe09bd20a27a · Note
• https://github.com/keycloak/keycloak/pull/49129 · Note
• https://github.com/keycloak/keycloak/issues/49118 · Note
• https://t.me/cveNotify/165852 · Telegram Post
• https://t.me/cveNotify/176476 · Telegram Post