CVE-2026-1035: Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.
Other sources
A race condition (Time-of-Check to Time-of-Use) exists in the TokenManager class, specifically within the validateTokenReuse method. This vulnerability allows an attacker to bypass the refreshTokenMaxReuse security policy when it is set to zero (strict single-use). By sending concurrent requests, a single refresh token can be exchanged for multiple valid access tokens before the usage counter is updated, undermining the Refresh Token Rotation hardening measure.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1035?
CVE-2026-1035 is classified as a medium severity vulnerability.
How do I fix CVE-2026-1035?
To fix CVE-2026-1035, upgrade to Keycloak version 26.2.6 or later which addresses the refresh token reuse issue.
What specific component is affected by CVE-2026-1035?
CVE-2026-1035 affects the TokenManager class in the Keycloak server's refresh token processing.
What type of vulnerability is CVE-2026-1035?
CVE-2026-1035 is a toctou race condition vulnerability that impacts refresh token policies.
Are all Keycloak versions vulnerable to CVE-2026-1035?
CVE-2026-1035 affects Keycloak server versions up to and including 26.2.5.