CVE-2026-18218
Received Received - Intake

Token Revocation Bypass in Keycloak

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-18218
EUVD
EUVD-2026-51478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's TokenManager component. When an admin tries to revoke tokens for an application using a 'not-before' policy, the revocation may fail silently if the realm already has an older revocation policy. This allows previously issued tokens to stay valid, letting users refresh sessions and access data even after revocation attempts.

Detection Guidance

To detect this vulnerability, check Keycloak server logs for token revocation attempts that were silently ignored. Look for mismatches between realm-level and client-level not-before timestamps. Verify if token refresh or introspection requests succeed despite revocation policies.

Impact Analysis

If you use Keycloak, attackers could exploit this to maintain access to systems or data even after token revocation. Users with revoked tokens might still refresh sessions or access unauthorized resources, increasing risk of data breaches or unauthorized actions.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of access (e.g., GDPR's right to be forgotten or HIPAA's access controls). Unauthorized token persistence may lead to unauthorized data access, resulting in non-compliance penalties or audit failures.

Mitigation Strategies

Update Keycloak to the latest patched version to address the TokenManager flaw. Review and adjust revocation policies to ensure older policies do not interfere with new revocations. Monitor token revocation logs for unexpected behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart