CVE-2026-9802

Modified Modified - Updated After Analysis

Refresh Token Replay in Keycloak

Publication date: 2026-05-28

Last updated on: 2026-06-26

Assigner: Red Hat, Inc.

Description

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-26

Generated

2026-07-07

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-9802

EUVD

EUVD-2026-32720

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	build_of_keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability exists in Keycloak when the setting revokeRefreshToken=true is enabled and persistent session storage is used. If the server is restarted, internal timing mechanisms that track token revocation can be reset. As a result, a remote attacker who has previously captured a user's refresh token can replay that token even after it has been revoked.

This means the attacker can gain unauthorized access to the victim's account by using the replayed refresh token.

Impact Analysis

The impact of this vulnerability is that an attacker can gain unauthorized access to a user's account by replaying a revoked refresh token after a server restart.

Unauthorized access to user accounts.
Potential information disclosure.
Possible privilege escalation.

Mitigation Strategies

To mitigate this vulnerability, ensure that the revokeRefreshToken setting is carefully managed and consider avoiding server restarts when persistent session storage is in use until a patch or fix is applied.

Additionally, monitor for updates or patches from Keycloak or your vendor and apply them promptly to address the issue.

Compliance Impact

This vulnerability allows unauthorized access to user accounts by enabling replay of revoked refresh tokens after a server restart. Such unauthorized access can lead to information disclosure or privilege escalation.

Because of the potential for unauthorized access and information disclosure, this flaw could negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Hi! I’m here to help you understand CVE-2026-9802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70