A flaw was found in the TokenManager.NotBeforeCheck logic within keycloak-services. The vulnerability occurs when a realm has a nonzero not-before timestamp (e.g., from a previous global revocation or import) and an administrator subsequently sets a newer client-specific not-before timestamp to revoke tokens for a single client. Due to a logic error in how these policies are compared (incorrectly prioritizing the older realm-level value or failing to evaluate the newer client-level value), the client-level revocation is ignored.
An authenticated attacker holding OIDC tokens (access or refresh) issued after the realm not-before but before the client not-before can continue to use these tokens. Specifically, an attacker can successfully perform token refresh requests, receive an active status from the introspection endpoint, and retrieve user claims from the UserInfo endpoint, bypassing the intended revocation.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━