Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T10:07:47 keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CWE-863

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to be an authenticated user and the target resource must be specifically protected by a time-based authorization policy. Successful exploitation allows an attacker to bypass temporal access controls and obtain permissions outside of allowed time windows. The vulnerability's root cause is the improper merging of user-supplied claims which allows them to overwrite trusted server-side evaluation attributes. Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue. Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-18572 https://nvd.nist.gov/vuln/detail/CVE-2026-18572