CVE-2026-8922
A flaw was found in Keycloak.
Published May 19, 2026 · updated Jul 23, 2026 · redhat build of keycloak
A flaw was found in Keycloak. When both realm-level and client-level revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 19, 2026 · NIST NVD
Detected
A flaw was found in Keycloak. When both realm-level and client-level revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing
Jul 23, 2026 · NIST NVD
Updated
A flaw was found in Keycloak. When both realm-level and client-level revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing
Affected
- cpe redhat/build of keycloakversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-8922
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-8922
A flaw was found in Keycloak. When both realm-level and client-level revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain a
nvd.nist.gov