CVE-2026-9802

Published May 28, 2026

Last updated 25 days ago

CVSS medium 6.8

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-9802 describes a vulnerability identified in Keycloak, an open-source identity and access management solution. This flaw manifests when Keycloak is configured with `revokeRefreshToken=true` and utilizes persistent session storage. Under these specific conditions, a server restart can inadvertently reset internal timing mechanisms responsible for managing refresh tokens. The vulnerability allows a remote attacker, who has previously obtained a user's refresh token, to replay that token even after it has been revoked. This replaying of a revoked token grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

Description
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.
Source
secalert@redhat.com
NVD status
Modified
Products
build_of_keycloak

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.8
Impact score
5.2
Exploitability score
1.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity
MEDIUM

Weaknesses

secalert@redhat.com
CWE-613

Social media

Hype score
Not currently trending

  1. #Keycloak pwnage, all public. 1: CVE-2026-4282 forges admin tokens unauth 2: view-clients leaks every client secret, all versions, open #49220 (PoC: https://t.co/cHWnrejmtR) 3: restart revives rotated refresh tokens, CVE-2026-9802 Not every vuln has a CVE https://t.co/ishDz8aqrN

    @kmkz_security

    24 Jun 2026

    18519 Impressions

    36 Retweets

    166 Likes

    142 Bookmarks

    3 Replies

    0 Quotes

Configurations

Related CVEs

  1. A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.•CVE-2026-4629
  2. A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.•CVE-2026-14209
  3. A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.•CVE-2026-12388
  4. A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.•CVE-2026-11800
  5. A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.•CVE-2026-9800

References

Sources include official advisories and independent security research.