CVE-2026-8922

[CVE catalog]

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management. org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: Security flaw in org.keycloak/keycloak-services This Moderate impact flaw in Red Hat Build of Keycloak allows revoked OpenID Connect (OIDC) tokens to remain active due to a failure in honoring realm-level revocation policies when client-level `notBefore` values are also configured. This occurs because the client-level setting can interfere with the intended realm-level revocation, leading to a temporary bypass of security controls. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Published

May 18, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.28% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "build_of_keycloak",
      "ecosystem": "cpe",
      "fixed_version": ""
    }
  ]
}