CVE-2026-8922

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-8922
A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2026-8922 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2479586 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
History

03 Jun 2026, 19:35

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2026-8922 - () https://access.redhat.com/security/cve/CVE-2026-8922 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2479586 - () https://bugzilla.redhat.com/show_bug.cgi?id=2479586 - Issue Tracking, Vendor Advisory
CPE cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
First Time Redhat
Redhat build Of Keycloak

19 May 2026, 08:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-19 08:16

Updated : 2026-06-03 19:35

NVD link : CVE-2026-8922

Mitre link : CVE-2026-8922

CVE.ORG link : CVE-2026-8922

JSON object : View

Products Affected

redhat

  • build_of_keycloak
CWE
CWE-303

Incorrect Implementation of Authentication Algorithm