CVE-2026-93999

Received Received - Intake

Keycloak OIDC Token Refresh Audience Validation Bypass

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: redhat-SADP

Description

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93999

Affected Vendors & Products

Vendor	Product	Version / Range
keycloak	keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in Keycloak's OIDC protocol implementation during token refresh. When restoring audiences from client IDs, Keycloak does not check if the target client is still enabled before issuing new access tokens. This allows an application with a valid refresh token to get access tokens for a disabled client, bypassing access controls.

Impact Analysis

An attacker with a valid refresh token could obtain new access tokens for a disabled client, gaining unauthorized access to resources that rely on offline JWT validation. This could lead to data breaches or unauthorized actions if the disabled client had privileged access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of least privilege and data protection. It may result in non-compliance with GDPR (data protection), HIPAA (health data security), or other regulations requiring strict access controls and auditability.

Mitigation Strategies

Disable any client applications that are no longer needed or trusted. Review and revoke refresh tokens for affected clients. Monitor access logs for unusual token refresh activity. Ensure all client applications are properly validated before issuing new access tokens.

Hi! I’m here to help you understand CVE-2026-93999. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70