Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-8922, in Keycloak allows revoked tokens to remain active when both realm-level and client-level notBefore revocation policies are configured. The core of the issue is that Keycloak's OIDC introspection and other token validation mechanisms were not correctly honoring the realm-level policy in this specific scenario. The analysis of the provided patches reveals that several functions across different parts of the Keycloak codebase were missing the necessary checks for the realm-level notBefore policy. The fix was to consistently add TokenManager.NotBeforeCheck.forModel(realm) to the token verification logic in all relevant places, including the token introspection provider, the generic token manager, and the UserInfo endpoint. By failing to check the realm-level policy, these functions would incorrectly validate a token that had been revoked at the realm level, as long as it was still valid according to the client-level policy. This could lead to unauthorized access if an attacker is in possession of such a token.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | <= 26.6.2 |
