6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9802

CVE-2026-9802: Keycloak has Insufficient Session Expiration

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9802

CVE-2026-9802:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	<= 26.4.7
org.keycloak:keycloak-services	maven	>= 26.5.0, < 26.6.3	26.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, allows for refresh token replay after a server restart due to a reset of internal timing mechanisms. The provided patches all point to a single file, services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java, and a specific method, validateTokenReuse. The change in the patch is the removal of a check that compares the token's last refresh time with the server's startup time (startupTime <= lastRefresh). This check is the root cause of the vulnerability. After a server restart, startupTime is updated, which could make a previously revoked (and therefore stale) token appear valid again. The vulnerable function is org.keycloak.protocol.oidc.TokenManager.validateTokenReuse because it contained this flawed logic. The fix removes the dependency on the server startup time for token validation, thus mitigating the replay attack.

Vulnerable functions

org.keycloak.protocol.oidc.TokenManager.validateTokenReuse

services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java

The vulnerability lies in the `validateTokenReuse` function. Before the patch, this function used the server's `startupTime` to validate a refresh token. If the server restarted, this `startupTime` would be reset. An attacker with a previously revoked refresh token could then reuse it because the new `startupTime` would be more recent than the `lastRefresh` time associated with the token, bypassing the check and gaining unauthorized access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.