CVE-2026-18218: Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Other sources
A flaw was found in the TokenManager.NotBeforeCheck logic within keycloak-services. The vulnerability occurs when a realm has a nonzero not-before timestamp (e.g., from a previous global revocation or import) and an administrator subsequently sets a newer client-specific not-before timestamp to revoke tokens for a single client. Due to a logic error in how these policies are compared (incorrectly prioritizing the older realm-level value or failing to evaluate the newer client-level value), the client-level revocation is ignored. An authenticated attacker holding OIDC tokens (access or refresh) issued after the realm not-before but before the client not-before can continue to use these tokens. Specifically, an attacker can successfully perform token refresh requests, receive an active status from the introspection endpoint, and retrieve user claims from the UserInfo endpoint, bypassing the intended revocation. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18218?
CVE-2026-18218 has a medium severity rating of 4.2.
How do I fix CVE-2026-18218?
To fix CVE-2026-18218, upgrade to the latest version of Keycloak that addresses this vulnerability.
What does CVE-2026-18218 involve?
CVE-2026-18218 involves a flaw in the TokenManager where token revocation for a specific client may be ignored based on the realm's not-before policy.
What are the potential impacts of CVE-2026-18218?
The potential impacts of CVE-2026-18218 include unauthorized access due to ineffective token revocation.
Is CVE-2026-18218 a common vulnerability in Keycloak?
CVE-2026-18218 is a specific and critical vulnerability that users of Keycloak should be aware of and take action to mitigate.