CVE-2026-18218 in Keycloak
Summary
by MITRE • 07/31/2026
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability exists within the TokenManager component of Keycloak, a widely deployed identity management service that handles authentication and authorization for numerous enterprise applications. This flaw represents a critical security oversight in the token revocation mechanism, specifically affecting how administrators manage access control through "not-before" policies. The issue manifests when an administrator attempts to revoke tokens for a particular application client while the security realm already contains an existing revocation policy with a non-zero timestamp, creating a silent failure condition that undermines the intended security controls.
The technical flaw stems from a logical inconsistency in the token validation process where the system fails to properly override or merge conflicting revocation policies. When a new "not-before" policy is applied to revoke tokens for a specific client, the system does not adequately check whether existing realm-level policies might conflict with the new directive. This results in a scenario where the newer revocation attempt is silently ignored without any error indication to the administrator. The underlying mechanism appears to prioritize existing policies over new ones without proper validation, creating a persistent security gap that allows compromised tokens to remain functional despite administrative intent to invalidate them.
From an operational impact perspective, this vulnerability creates a significant risk for organizations relying on Keycloak for identity management, particularly those with strict access control requirements and compliance obligations. The silent failure means that administrators may believe they have successfully revoked tokens when in reality the system continues to accept previously issued credentials for session refreshes and resource access. This could enable unauthorized access to sensitive information, privilege escalation attacks, or continued access by compromised user accounts long after administrative revocation actions have been implemented. The vulnerability essentially undermines the principle of least privilege and can lead to prolonged exposure windows where malicious actors might exploit this gap.
Security standards such as CWE-691 and CWE-310 provide relevant context for understanding this issue, as it involves insufficient control flow management and inadequate security policy enforcement mechanisms. The flaw aligns with ATT&CK technique T1566 which covers credential access through compromised credentials, and T1078 which addresses valid account use. Organizations should implement immediate mitigations including monitoring for token revocation attempts, establishing robust audit trails for administrative actions, and considering temporary workarounds such as manually clearing all tokens or implementing additional access controls. The recommended approach includes upgrading to patched versions of Keycloak, implementing comprehensive logging of token management operations, and conducting thorough security assessments of existing token policies within the realm configurations.