PT-2026-44195 · Red Hat · Red Hat Build Of Keycloak

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-9802

Mitre

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-9802

Affected Products

Red Hat Build Of Keycloak

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9802 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-9802 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2482467 · Note