CVE-2026-18218: Keycloak Auth Bypass Vulnerability

CVE-2026-18218 Overview

CVE-2026-18218 is a missing authorization flaw [CWE-862] in the TokenManager component of Keycloak, Red Hat's identity and access management service. When an administrator issues a per-client not-before policy to revoke tokens for a specific application, Keycloak silently ignores the revocation if the parent realm already carries an older, non-zero not-before value. Previously issued tokens continue to refresh sessions and access user information after the administrator believes them invalidated. The issue undermines a core administrative control that operators rely on to contain compromised sessions.

Critical Impact
Tokens an administrator attempted to revoke remain valid for session refresh and user information access, defeating an expected containment control during incident response.

Affected Products

Keycloak identity and access management service
Red Hat build of Keycloak
Downstream distributions embedding the vulnerable TokenManager component

Discovery Timeline

2026-07-31 - CVE-2026-18218 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18218

Vulnerability Analysis

Keycloak enforces token revocation using not-before (nbf) policies. Any token issued before the configured timestamp is treated as invalid. Administrators can set these policies at two scopes: the realm and an individual client.

The TokenManager component evaluates the two scopes incorrectly. When a client-specific not-before value is applied, the manager compares it against the existing realm-level policy and only honors the newer of the two at the wrong scope. As a result, a client-scoped revocation issued while the realm already has an older non-zero policy is discarded without error.

The administrator receives no indication that the operation failed. Refresh tokens and access tokens minted before the intended revocation remain accepted at the /token and /userinfo endpoints. An attacker holding a stolen refresh token can maintain persistence across the intended revocation boundary.

Root Cause

The root cause is missing authorization enforcement in the TokenManager policy comparison logic [CWE-862]. The component applies an incorrect precedence rule between realm-scope and client-scope not-before timestamps, allowing an older realm value to mask a newer client-scoped revocation.

Attack Vector

Exploitation requires an attacker to already possess a valid token issued before the intended revocation, for example a refresh token captured through phishing, log exposure, or a prior compromise. The attacker submits the token to the Keycloak token endpoint after the administrator has attempted revocation. Because the client-scoped policy was silently ignored, Keycloak accepts the token and returns a fresh access token, extending unauthorized access to the target application.

The vulnerability requires low-privilege access to a compromised token and a realm state where an older, non-zero not-before value is already configured. See the Red Hat CVE Advisory and Red Hat Bug Report for vendor technical details.

Detection Methods for CVE-2026-18218

Indicators of Compromise

Successful /protocol/openid-connect/token refresh grants using tokens whose iat timestamp precedes an administrator's client-level revocation action.
Successful /protocol/openid-connect/userinfo calls presenting access tokens that should have been invalidated by a client not-before policy.
Audit events showing a client not-before policy update followed by continued session activity for that client.

Detection Strategies

Correlate Keycloak admin audit logs (UPDATE_CLIENT_POLICY, NOT_BEFORE_POLICY_SET) with subsequent token issuance events for the same client_id.
Compare token iat claims against the current client-scoped notBefore value stored in the realm database; flag any accepted token where iat < notBefore.
Alert on refresh token reuse across a suspected credential compromise window even after a documented revocation attempt.

Monitoring Recommendations

Forward Keycloak event listener output and admin audit events to a centralized log platform for retention and correlation.
Track the ratio of revocation events to subsequent successful token grants per client to surface silent-failure patterns.
Monitor upstream Keycloak security advisories and the Red Hat CVE Advisory for fixed version announcements.

How to Mitigate CVE-2026-18218

Immediate Actions Required

Apply the fixed Keycloak or Red Hat build of Keycloak release once published in the Red Hat CVE Advisory.
Rotate signing keys for affected realms; a passive key rotation invalidates all outstanding tokens regardless of not-before state.
Force logout of all active sessions for the affected client using the admin console Logout all action after key rotation.

Patch Information

At the time of publication, refer to the Red Hat CVE Advisory and Red Hat Bug Report for the authoritative list of fixed component versions and errata identifiers.

Workarounds

When client-scoped revocation is required, also raise the realm-level not-before timestamp to a value newer than the existing realm policy so revocation is enforced at the realm scope.
Perform a realm signing key rotation as the reliable substitute for token revocation until the patched release is deployed.
Reduce refresh token lifetime and access token lifetime in realm settings to limit the window during which a bypassed revocation remains useful.

bash

# Force realm-wide revocation via kcadm.sh as a workaround
# Sets notBefore to the current epoch time for the target realm
kcadm.sh update realms/<realm-name> \
  -s 'notBefore='$(date +%s)

# Rotate the active signing key to invalidate all outstanding tokens
kcadm.sh create keys -r <realm-name> \
  -s providerId=rsa-generated \
  -s 'config.priority=["200"]' \
  -s 'config.active=["true"]'