CVE-2026-107623 in Keycloak
Summary
by MITRE • 10/08/2026
A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Keycloak affects the OpenID Connect Dynamic Client Registration component, specifically within the logic handling response serialization during client configuration updates. This flaw manifests as an omission of the backchannel logout offline token revocation setting from API responses when a standard update operation is performed on a registered client. In typical operational scenarios, administrators or automated systems interact with this endpoint to modify existing client configurations without intending to alter every possible attribute associated with that client. However, due to the serialization bug, the system fails to preserve and return the current state of the offline token revocation setting in its response payload. This omission is not merely a cosmetic issue but represents a critical logic error where the absence of data in the response leads downstream processes or clients interpreting this output to assume that the feature has been explicitly disabled rather than simply unreported.
The operational impact of this flaw is significant for organizations relying on Keycloak for identity and access management, particularly those utilizing offline tokens for long-lived authentication scenarios such as mobile applications or single-page applications with refresh token flows. Offline tokens are designed to allow users to maintain authenticated sessions even when they are not actively interacting with the application, provided these tokens remain valid within their configured lifetime. When a client performs an update operation that triggers this serialization bug, the backchannel logout offline token revocation setting is silently disabled. Consequently, if a user session is terminated via backchannel logout mechanisms intended to invalidate active sessions and associated credentials, the offline tokens issued prior to or during that period may remain valid. This creates a window of opportunity where an attacker who has obtained these stale offline tokens can continue to authenticate as the victim despite the administrative intent to revoke access.
This behavior directly contradicts security best practices for session management and token lifecycle control. The failure to properly handle the revocation state means that the principle of least privilege is compromised, as users retain elevated privileges beyond their intended active sessions. This vulnerability aligns with CWE-20 Improper Input Validation in terms of how internal states are processed during updates, but more critically it maps to CWE-613 Insufficient Session Expiration because the tokens do not expire or get invalidated when they should according to security policies. From an adversary perspective, this flaw facilitates unauthorized access and persistence within a compromised environment, mapping closely to ATT&CK technique T1078 Valid Accounts where attackers leverage legitimate credentials that have not been properly revoked due to system misconfiguration.
Mitigation strategies must address both the immediate technical defect and broader architectural controls. Administrators should ensure they are running patched versions of Keycloak where this serialization bug has been resolved, as upstream developers typically release hotfixes for such critical logic errors in identity management systems. In environments where patching is not immediately feasible, manual verification of client configurations after any update operation is recommended to confirm that the offline token revocation settings remain enabled and consistent with organizational security policies. Furthermore, organizations should implement rigorous monitoring and alerting around backchannel logout events and subsequent token usage patterns to detect anomalies indicative of this vulnerability being exploited. Long-term remediation involves adopting a defense-in-depth approach where session management logic is decoupled from client registration updates to prevent such state corruption during routine administrative tasks.