Bug 2508313 (CVE-2026-18218)

Summary:	CVE-2026-18218 keycloak-services: keycloak-services: Client not-before revocation ignored when realm not-before is older but nonzero
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-29 09:01:25 UTC

A flaw was found in the TokenManager.NotBeforeCheck logic within keycloak-services. The vulnerability occurs when a realm has a nonzero not-before timestamp (e.g., from a previous global revocation or import) and an administrator subsequently sets a newer client-specific not-before timestamp to revoke tokens for a single client. Due to a logic error in how these policies are compared (incorrectly prioritizing the older realm-level value or failing to evaluate the newer client-level value), the client-level revocation is ignored.
An authenticated attacker holding OIDC tokens (access or refresh) issued after the realm not-before but before the client not-before can continue to use these tokens. Specifically, an attacker can successfully perform token refresh requests, receive an active status from the introspection endpoint, and retrieve user claims from the UserInfo endpoint, bypassing the intended revocation.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━