CVE-2026-9802

Vulnerability

A flaw was found in Keycloak, where the server restart can reset internal timing mechanisms when revokeRefreshToken=true is enabled and persistent session storage is in use. This affects versions using persistent session storage and the revoke refresh token feature. The exact affected versions are not detailed in the available references [1][2].

Exploitation

A remote attacker who has previously captured a user's refresh token can replay that token after a server restart, even if the token was revoked before the restart. The attacker does not need any special network position beyond being able to send the captured token. No user interaction is required for the replay [1][2].

Impact

Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation. The impact aligns with the CVSS 6.8 (Medium) severity, indicating a significant but not critical risk [1][2].

Mitigation

Not yet disclosed in the available references. The references do not provide a fix version, workaround, or EOL status. Users should monitor Red Hat and Keycloak advisories for updates [1][2].