CVE-2026-9802: redhat build_of_keycloak Insufficient Session Expiration

Vulnerability summary

CVE-2026-9802 is a medium (CVSS 6.8) Insufficient Session Expiration vulnerability in redhat build_of_keycloak. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.9% of scored vulnerabilities.

Timeline

1. 28-05-2026
   PublishedVulnerability first disclosed.
2. 26-06-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."