CVE-2026-1035: Keycloak Services Refresh Token Processing Vulnerability
Summary
CVE-2026-1035: Keycloak does not validate and update refresh token usage atomically. Affects org.keycloak:keycloak-services versions < 26.2.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The Keycloak server is responsible for managing user sessions and tokens, ensuring secure access to applications. However, a flaw in the refresh token processing can lead to security vulnerabilities, particularly when strict refresh token rotation is enabled.
Vulnerability Detail
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined, potentially leading to unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling strict refresh token rotation until the package is updated. This can be done by modifying the Keycloak configuration settings to allow for less stringent token reuse policies, although this may expose your application to security risks.
Conclusion
In summary, the Keycloak services package has a vulnerability related to refresh token processing that can lead to unauthorized access if not addressed. It is crucial to update to the latest version to mitigate this risk and consider using tools like Vulert for ongoing monitoring.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The vulnerability allows multiple access tokens to be issued from the same refresh token due to non-atomic validation and update processes.
If your application uses Keycloak with strict refresh token rotation enabled, it may be susceptible to unauthorized access due to the flawed token management.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the pom.xml file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
