REDHAT-BUG-2509763: Medium severity Keycloak Keycloak vulnerability

Published Jul 31, 2026

Updated

A vulnerability was found in Keycloak where authenticated users can bypass authorization services time policies. When requesting a User-Managed Access (UMA) permission, a caller can supply a claim token containing forged kc.time.datetime values. Keycloak merges these caller-supplied claims after the server-generated time attributes, allowing the forged values to overwrite the server clock during policy evaluation. This allows an attacker to obtain Resource Permission Tokens (RPTs) outside of the time windows configured by administrators, effectively defeating temporal access controls such as maintenance windows or off-hours access denials.

Affected Software

1 affected component

Keycloak Keycloak

Event History

Jul 31, 2026

Data Sourced

via Red Hat·12:33 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2509763?

The severity of REDHAT-BUG-2509763 is medium with a risk rating of 4.

How do I fix REDHAT-BUG-2509763?

To fix REDHAT-BUG-2509763, ensure you update Keycloak to the latest version that addresses this vulnerability.

What does REDHAT-BUG-2509763 affect?

REDHAT-BUG-2509763 affects the Keycloak software, particularly its authorization services.

What type of vulnerability is REDHAT-BUG-2509763?

REDHAT-BUG-2509763 is an authentication and authorization vulnerability that allows users to bypass time policies.

Who can exploit the vulnerability REDHAT-BUG-2509763?

Authenticated users can exploit the vulnerability REDHAT-BUG-2509763 by supplying forged claim tokens.