CVE-2026-9802: Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9802?
The severity of CVE-2026-9802 is rated as medium with a score of 6.8.
What is CVE-2026-9802 about?
CVE-2026-9802 involves unauthorized account access via replayed refresh tokens after a server restart in Keycloak.
How do I fix CVE-2026-9802?
To mitigate CVE-2026-9802, consider disabling persistent session storage or ensure that revokeRefreshToken is set to false.
What are the potential impacts of CVE-2026-9802?
CVE-2026-9802 can allow remote attackers to gain unauthorized access to user accounts by replaying captured refresh tokens.
Who is affected by CVE-2026-9802?
CVE-2026-9802 affects users of Keycloak when persistent session storage is enabled and revokeRefreshToken is set to true.