CVE-2026-9802

Description

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user-s refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim-s account, potentially leading to information disclosure or privilege escalation.