What’s Vulnerable › Vulnerabilities

CVE-2026-18218: Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-31 · updated 2026-09-16
• Weakness: CWE-862

Description

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/errata/RHSA-2026:68277
• https://access.redhat.com/errata/RHSA-2026:68278
• https://access.redhat.com/security/cve/CVE-2026-18218
• https://bugzilla.redhat.com/show_bug.cgi?id=2508313

Get alerted when CVE-2026-18218 or the next vulnerability affects your stack