Red HatCVE-2026-18218
Red Hat TokenManager: missing authorization
Medium4.2CVE-2026-18218 · Published Jul 31, 2026 · updated Sep 16, 2026
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Data Grid 8 Product | all versions | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack Product | all versions | No fix yet |
| Red Hat Single Sign-On 7 Product | all versions | No fix yet |
| Red Hat build of Keycloak 26.6.7 Product | all versions | No fix yet |
| all versions | No fix yet | |
| all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-862
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 31 | Red Hat Ansible Automation Platform 2: improper certificate validation | High8.2 | No fix yet |
| Jul 31 | Red Hat gnome-remote-desktop as shipped: resource exhaustion | High7.5 | No fix yet |
| Jul 31 | A flaw was found in 389 Directory Server | High7.5 | No fix yet |
| Jul 31 | Red Hat: buffer overflow | High7.5 | No fix yet |
| Jul 31 | Red Hat Advanced Cluster Security 4: insufficient authenticity check | High8.5 | No fix yet |
| Jul 31 | Red Hat SAML protocol implementation of Keycloak: improper input validation | Low3.4 | No fix yet |