Cyber Resilience

CVE-2026-8922

Auth Bypass in Redhat Build Of Keycloak

Auth Bypass
Published
19 May 2026
Modified
23 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0028 20th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-8922 is a medium-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-12 (Session Termination) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active,…

more

potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.

CWE(s)
CWE-303

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Bypass of token revocation enables continued use of accounts via valid tokens that should be invalid.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1556.006 Multi-Factor Authentication Defense Impairmentconfidence: MEDIUM
Bypassing realm-level token revocation via flawed OIDC introspection enables continued use of compromised or revoked authentication material.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-12388Same product: Redhat Build Of Keycloak
CVE-2026-9802Same product: Redhat Build Of Keycloak
CVE-2026-4325Same product: Redhat Build Of Keycloak
CVE-2026-9799Same product: Redhat Build Of Keycloak
CVE-2026-9793Same product: Redhat Build Of Keycloak
CVE-2024-7318Same product: Redhat Build Of Keycloak
CVE-2026-4628Same product: Redhat Build Of Keycloak
CVE-2026-37982Same product: Redhat Build Of Keycloak
CVE-2026-3911Same product: Redhat Build Of Keycloak
CVE-2026-9796Same product: Redhat Build Of Keycloak

Affected Assets

redhat
build of keycloak
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-12 Session Termination
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces access decisions so that tokens failing realm-level notBefore revocation checks are rejected during OIDC introspection.

AC-12 Session Termination partial match
prevent

Forces termination of sessions/tokens once a notBefore revocation timestamp is reached, mitigating the incomplete policy evaluation bug.

SI-4 System Monitoring partial match
detect

Monitors authentication and authorization events to identify active tokens that should have been revoked by realm-level policy.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct implementation of authentication algorithms.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
degrades

Secure authentication control directly requires correct implementation of authentication algorithms.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect flawed authentication implementations but does not prevent them by itself.

A.8.24 Use of cryptography partial match
degrades

Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes verification steps that can catch incorrect authentication implementations.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify correct authentication algorithm use but do not guarantee correct implementation.

A.8.28 Secure coding partial match
prevents

Secure coding practices reduce the likelihood of incorrect authentication algorithm implementation.

References