6.8
Medium
CVE-2026-9802 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Keycloak 26.6.3 | Versions not published | |
| Red Hat build of Keycloak 26.6 26.6 | earliest → < 26.6-6 | 26.6-6 |
| Red Hat build of Keycloak 26.6.4 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-19 | 26.4-19 |
| Red Hat build of Keycloak 26.4.13 | Versions not published |
References
- RHSA-2026:25097 access.redhat.com
- RHSA-2026:25098 access.redhat.com
- RHSA-2026:30049 access.redhat.com
- RHSA-2026:30050 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2482467 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 276 CVEs of Red Hat Build of Keycloak →
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Medium
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium