CVE-2026-18218

The vulnerability CVE-2026-18218 affects Keycloak’s TokenManager component. When an administrator revokes tokens for a specific client under a not-before policy, revocation can be silently ignored if the realm’s overall not-before policy is older but non-zero. As a result, previously issued token...

CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...