CVE-2026-107623: Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-08
Weakness: CWE-862

Description

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.

Affected products

Red Hat build of Keycloak 26.4: all versions

References

https://access.redhat.com/security/cve/CVE-2026-107623
https://bugzilla.redhat.com/show_bug.cgi?id=2547957

Get alerted when CVE-2026-107623 or the next vulnerability affects your stack