CVE-2026-8922CWE-303

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Medium · published May 19, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.0th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-05-19T06:27Z
EPSS history
Timeline
  • 19 MAY 06:27Z
    Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services
    cvelistv5