CVE-2026-107623: Keycloak Auth Bypass Vulnerability

CVE-2026-107623 Overview

CVE-2026-107623 is a flaw in the OpenID Connect (OIDC) Dynamic Client Registration (DCR) component of Keycloak. A response serialization bug omits the backchannel logout offline token revocation setting from DCR responses. When a client performs a standard update using that response, the missing field causes the setting to be silently disabled. As a result, offline tokens may remain valid after a user session is terminated via backchannel logout, undermining the expected session termination guarantee for OIDC relying parties.

Critical Impact
Offline refresh tokens can survive a backchannel logout event, allowing continued access to protected resources after the user session is expected to be terminated.

Affected Products

Red Hat Keycloak (OIDC Dynamic Client Registration component)
Red Hat Build of Keycloak distributions
Downstream products embedding the affected Keycloak OIDC DCR code

Discovery Timeline

2026-10-08 - CVE-2026-107623 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107623

Vulnerability Analysis

The weakness is categorized as Missing Authorization [CWE-862]. In practice, the flaw behaves as a configuration persistence defect in the OIDC Dynamic Client Registration workflow. Keycloak serializes the client registration response without including the backchannel.logout.revoke.offline.tokens setting. A relying party that reads the response, modifies attributes, and submits a PUT update sends back a representation that no longer carries the field. Keycloak interprets the absent field as disabled and persists the change.

The downstream effect is that backchannel logout notifications no longer trigger revocation of offline tokens issued to the client. An offline refresh token obtained before logout can continue to mint new access tokens. This breaks the OIDC Back-Channel Logout 1.0 expectation that an sid-targeted logout terminates associated token material.

Root Cause

The root cause is incomplete field coverage in the DCR response serializer. The serializer omits one client configuration attribute from the JSON representation. The DCR update handler then treats a non-present field as an explicit false, rather than preserving the stored value. The combination silently flips the security-relevant setting during an otherwise benign client update.

Attack Vector

Exploitation requires an authenticated actor with privileges to perform Dynamic Client Registration operations against the Keycloak realm. The attack is network-reachable and requires no user interaction. An attacker, or any client automation that round-trips the DCR representation, can disable offline token revocation for a target client without directly setting the flag. Any offline tokens issued after this change persist across backchannel logout events for that client until manually revoked or expired.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-107623 Advisory and Red Hat Bug Report #2547957 for upstream technical detail.

Detection Methods for CVE-2026-107623

Indicators of Compromise

Keycloak clients whose backchannel.logout.revoke.offline.tokens attribute transitions from true to false without an administrator-initiated change in the admin console audit log.
OIDC relying parties that continue to present valid access tokens derived from offline refresh tokens after a confirmed backchannel logout event for the associated sid.
DCR PUT requests to /realms/{realm}/clients-registrations/openid-connect/{clientId} whose JSON body omits the backchannel logout revocation field.

Detection Strategies

Audit all registered OIDC clients in each realm and compare the current value of backchannel.logout.revoke.offline.tokens against the intended baseline.
Correlate Keycloak admin events of type CLIENT_UPDATE with authentication events to identify clients whose configuration drifted following DCR operations.
Enable Keycloak event logging for LOGOUT, REFRESH_TOKEN, and CLIENT_UPDATE and alert when refresh token activity occurs after a backchannel logout for the same session identifier.

Monitoring Recommendations

Ship Keycloak admin and user events into a centralized log platform and build detections for post-logout offline token refresh activity.
Track the ratio of DCR update requests to configuration changes on security-sensitive client attributes.
Alert on long-lived offline sessions for clients that should enforce backchannel logout revocation.

How to Mitigate CVE-2026-107623

Immediate Actions Required

Inventory every OIDC client created or updated via Dynamic Client Registration and manually reassert backchannel.logout.revoke.offline.tokens=true where required by policy.
Revoke existing offline tokens for affected clients to invalidate sessions that may have survived prior backchannel logout events.
Restrict DCR access by requiring an initial access token or trusted registration policies, limiting who can trigger client updates.

Patch Information

Apply the fixed Keycloak build published by Red Hat. Consult the Red Hat CVE-2026-107623 Advisory for the current list of fixed packages across Red Hat Build of Keycloak and Red Hat Single Sign-On distributions, and the Red Hat Bug Report #2547957 for upstream patch references.

Workarounds

Disable Dynamic Client Registration for realms where it is not operationally required.
Enforce a client registration policy that forbids updates removing security-relevant attributes.
Periodically reconcile client configuration from a known-good source of truth and overwrite drift detected on the backchannel logout revocation setting.

bash

# Reassert backchannel logout offline token revocation for a client via kcadm
kcadm.sh update clients/<client-uuid> \
  -r <realm> \
  -s 'attributes."backchannel.logout.revoke.offline.tokens"=true'

# Revoke an existing offline session
kcadm.sh delete sessions/<session-id> -r <realm>