CVE-2026-18572: Keycloak Auth Bypass Vulnerability

CVE-2026-18572 Overview

CVE-2026-18572 is an authorization bypass vulnerability in Keycloak's time-based policy enforcement. Keycloak lets administrators restrict access to protected resources based on time policies, such as permitting access only during business hours. An authenticated user can inject a fake time value into their authorization request, and Keycloak evaluates that attacker-supplied value instead of the actual server time. This allows the user to bypass time-based restrictions and reach protected resources outside of authorized windows. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users can override the effective server time in authorization requests, bypassing time-based access policies and reaching protected resources outside permitted windows.

Affected Products

Red Hat build of Keycloak (see the Red Hat CVE Advisory for affected versions)
Keycloak deployments using time-based authorization policies
Applications relying on Keycloak authorization services for time-restricted access

Discovery Timeline

2026-08-02 - CVE-2026-18572 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18572

Vulnerability Analysis

Keycloak's authorization services support policy types that gate access to resources based on rules, including time policies that compare the current server time to configured windows. The vulnerability stems from the policy evaluator accepting a client-supplied time value in the authorization request and using it during policy evaluation. Rather than anchoring the decision to the trusted server clock, the evaluator honors the value provided by the caller. An authenticated user who crafts a request with a permitted time value causes the time policy to always evaluate as satisfied.

The issue directly undermines the integrity of authorization decisions, which is why the CWE mapping is CWE-863: Incorrect Authorization. Confidentiality is not directly impacted by disclosure of new data, but integrity of access control is broken because unauthorized time windows become reachable. Availability is unaffected.

Root Cause

The root cause is trusting attacker-controlled input as the authoritative time source for policy evaluation. Time policies must be evaluated against the server clock, and any user-supplied timestamp must be treated as untrusted metadata. Because the evaluator did not enforce this constraint, users could override the effective clock used by time-based policies.

Attack Vector

Exploitation requires an authenticated session and network access to the Keycloak authorization endpoint. The attacker submits an authorization request that includes a manipulated time value falling inside an allowed policy window. Keycloak evaluates the time policy against the injected value, returns a permit decision, and issues a Requesting Party Token that grants access to the protected resource outside its intended availability window. No user interaction and no elevated privileges are required beyond an ordinary authenticated account.

No verified public exploit code is available. See the Red Hat Bug Report for technical detail.

Detection Methods for CVE-2026-18572

Indicators of Compromise

Authorization requests to Keycloak that include time or claim parameters carrying timestamp values inconsistent with the server clock.
Successful token issuance for resources protected by time policies during hours the policy should deny.
Access logs on downstream applications showing legitimate users transacting outside their normal business-hour patterns.

Detection Strategies

Enable Keycloak event logging for CODE_TO_TOKEN, PERMISSION_TOKEN, and authorization decision events, and alert on token issuance times that fall outside configured policy windows.
Compare the iat and exp claims in issued Requesting Party Tokens against expected time-policy boundaries, and flag mismatches.
Correlate downstream application access logs with Keycloak authorization events to surface access that should have been denied by time policies.

Monitoring Recommendations

Ingest Keycloak admin, login, and authorization events into a central analytics platform for time-window analysis.
Baseline normal access patterns per role and alert on statistically significant activity outside baselined hours.
Monitor for repeated authorization requests from the same user containing anomalous claim values.

How to Mitigate CVE-2026-18572

Immediate Actions Required

Apply the vendor patch referenced in the Red Hat CVE Advisory as soon as fixed builds are available for your Keycloak distribution.
Inventory realms and clients that rely on time-based authorization policies and treat those resources as higher risk until patched.
Rotate or invalidate active Requesting Party Tokens for resources protected by time policies to force re-evaluation after the fix is deployed.

Patch Information

Red Hat tracks fix availability for affected Keycloak builds under this CVE. Refer to the Red Hat CVE Advisory and the associated Red Hat Bug Report for fixed package versions, errata identifiers, and upstream commits. Upgrade all Keycloak servers and, where applicable, container images and operators to the fixed release.

Workarounds

Enforce time restrictions at an additional layer, such as an API gateway or reverse proxy, using the server clock rather than tokens.
Reduce token lifetimes for clients that access time-restricted resources so bypassed access windows are short-lived.
Restrict which clients and users can request authorization for time-policy-protected resources until patches are applied.

bash

# Example: enforce time-of-day restriction at an nginx reverse proxy
# in front of a Keycloak-protected application as a defense-in-depth control.
map $time_iso8601 $business_hours {
    "~T(09|1[0-7]):"  1;
    default           0;
}

server {
    listen 443 ssl;
    server_name app.example.com;

    location /protected/ {
        if ($business_hours = 0) {
            return 403;
        }
        proxy_pass http://backend;
    }
}