Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-24T13:46:56 keycloak-services: keycloak-services: Client not-before revocation ignored when realm not-before is older but nonzero 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CWE-862

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific pre-existing realm configuration and the possession of valid tokens issued within a specific timeframe. Successful exploitation allows an attacker to continue using revoked tokens for refresh, introspection, and UserInfo requests. The vulnerability's root cause is a logic error in the TokenManager.NotBeforeCheck function that fails to correctly enforce client-specific revocation policies when a realm-level policy is also present. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-18218 https://nvd.nist.gov/vuln/detail/CVE-2026-18218