Missing Authorization in Keycloak - CVE-2026-18218
Published: July 31, 2026 / Updated: September 5, 2026
Vulnerability identifier: #VU146973
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18218
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retain access to user information and refresh sessions using previously issued tokens.
The vulnerability exists due to missing authorization in the TokenManager component when processing client-specific \"not-before\" token revocation policies. A remote user can continue using previously issued tokens after an administrator attempts to invalidate them to retain access to user information and refresh sessions.
The issue occurs when the security realm already has an older, non-zero revocation policy in place.
Affected software
Keycloak
How to mitigate CVE-2026-18218
Install security update from vendor's website.
Keycloak - update to 26.7.3