CVE-2026-9802: Keycloak Refresh Token Replay After Revocation

Technical summary

CVE-2026-9802 involves a flaw in Keycloak's token revocation mechanism (CWE-613: Insufficient Session Expiration). The vulnerability exists when revokeRefreshToken=true is configured with persistent session storage enabled. Upon server restart, internal timing mechanisms are reset, causing the revocation state to become unsynchronized. An attacker in possession of a previously-captured refresh token can exploit this desynchronization to replay the token and bypass authentication controls, even though it should have been invalidated. The vulnerability requires network-level access, high attack complexity (specific configuration and restart conditions), and relies on user interaction in the attack chain.

Business impact

Successful exploitation allows unauthorized account takeover, potentially exposing sensitive user data and enabling privilege escalation within integrated systems. In environments where Keycloak manages access to multiple applications or sensitive resources, a compromised token could provide lateral movement opportunities. The impact is heightened in organizations using Keycloak for identity federation or managing high-privilege accounts. However, the medium severity reflects that specific configuration and operational conditions must align for the flaw to be exploitable.

Affected systems

Red Hat Build of Keycloak is affected by this vulnerability. Organizations running Keycloak with both revokeRefreshToken=true enabled and persistent session storage configured are at risk. This particularly impacts deployments using Keycloak as a centralized identity provider for multiple applications or in hybrid cloud environments where service restarts are routine operational activities.

Exploitability

The attack requires three preconditions: (1) the attacker must have previously obtained a valid refresh token (likely through credential compromise or token theft), (2) the target environment must have both token revocation and persistent session storage enabled, and (3) a server restart must occur after revocation but before token expiry. The attack is triggered when the attacker attempts to refresh an access token using the captured refresh token. While not trivially exploitable, the conditions are realistic in production environments, particularly those with frequent deployment cycles or high-availability architectures requiring rolling restarts.

Remediation

Apply the vendor patch when available. As an interim measure, organizations should review their Keycloak configuration and consider disabling persistent session storage if operationally feasible, or implement additional controls to prevent refresh token capture (such as token rotation policies, secure token storage, and network-level access controls). Monitor for suspicious token refresh patterns, particularly around system restart windows.

Patch guidance

Verify the Red Hat security advisory for Keycloak to identify the patched version applicable to your deployment. Apply patches according to your change management process, prioritizing systems where Keycloak manages authentication for sensitive applications. Test token revocation behavior after patching to confirm that revoked tokens are properly rejected across server restarts.

Detection guidance

Monitor Keycloak authentication logs for refresh token reuse patterns, particularly for tokens that should have been revoked. Alert on multiple failed or successful token refresh attempts using identical token values, especially clustered around server restart events. Implement audit logging for token revocation events and correlate them with subsequent token usage. Review session storage integrity and synchronization across clustered Keycloak instances.

Why prioritize this

While the CVSS score of 6.8 (MEDIUM) reflects attack complexity requirements, the vulnerability carries business risk due to its impact on account confidentiality and integrity. Organizations should prioritize patching based on Keycloak's role in their identity infrastructure—higher priority for deployments serving multiple applications or managing privileged access. The vulnerability is not yet in the Known Exploited Vulnerabilities catalog, providing a window for proactive remediation.

Risk score, explained

The CVSS:3.1 score of 6.8 reflects: network-accessible attack surface (AV:N), high attack complexity due to configuration and operational preconditions (AC:H), no privilege requirement (PR:N), user interaction needed (UI:R), and impacts to confidentiality and integrity of victim accounts (C:H/I:H) but not availability (A:N). The medium severity appropriately accounts for the specific configuration requirements and operational conditions necessary to trigger the flaw.

Frequently asked questions