PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8922 Red Hat CVE debrief

A flaw in Keycloak's OpenID Connect (OIDC) Introspection feature causes the realm-level `notBefore` revocation policy to be improperly honored when a client-level `notBefore` policy is also configured. This allows tokens that should have been revoked to remain active, potentially enabling unauthorized access or continued session validity. The vulnerability affects systems using Keycloak for identity and access management. The issue was published on 2026-05-19 and is currently awaiting analysis in the NVD.

Vendor
Red Hat
Product
Red Hat Build of Keycloak
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-23
Advisory published
2026-05-19
Advisory updated
2026-07-23

Who should care

Organizations using Keycloak as an identity provider for OIDC/OAuth2 authentication, particularly those relying on `notBefore` revocation policies for security incident response or credential compromise recovery. Security teams responsible for token lifecycle management and access control policy enforcement.

Technical summary

The vulnerability exists in Keycloak's implementation of RFC 7662 OAuth 2.0 Token Introspection. When processing token introspection requests, the system evaluates revocation timestamps (`notBefore`) to determine if a token should be considered active. The flaw occurs when both realm-level and client-level `notBefore` policies are configured—the realm-level policy is not properly enforced, causing the introspection endpoint to incorrectly return 'active': true for tokens that should be revoked based on the realm-level timestamp. This represents an authentication bypass condition where revoked credentials may continue to be accepted by relying parties.

Defensive priority

medium

Recommended defensive actions

  • Review Keycloak realm and client configurations for `notBefore` revocation policy settings
  • Audit active tokens and sessions for potential unauthorized access following policy misconfigurations
  • Apply vendor-provided patches when available from Red Hat
  • Monitor OIDC introspection endpoint behavior for proper token rejection
  • Consider implementing additional token validation layers as compensating controls

Evidence notes

The vulnerability description indicates that Keycloak's OIDC Introspection endpoint fails to properly evaluate the realm-level `notBefore` timestamp when a client-level `notBefore` value is present. This suggests a logic error in the token validation code path where client-level settings may override or mask realm-level revocation policies. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-accessible attack vector with low attack complexity, requiring low privileges, with impacts to confidentiality and integrity but no availability impact. The weakness is classified as CWE-303 (Incorrect Implementation of Authentication Algorithm).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8922 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8922

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8922 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8922

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.