CVE-2026-18572: Keycloak Package Vulnerability Allowing Time Policy Override
Summary
CVE-2026-18572: Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). Affects keycloak versions < 26.7.3. Fixed in 26.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, user federation, identity brokering, and social login. Keycloak's authorization services enable administrators to enforce access controls based on various policies, including time-based restrictions. However, a vulnerability has been identified that allows users to manipulate time-based access controls, potentially leading to unauthorized access.
Vulnerability Detail
A flaw in Keycloak's authorization services allows users to include a fake time value in their authorization requests. This manipulation can override the server's actual time, enabling users to bypass time-based restrictions and access protected resources outside of permitted hours. This vulnerability poses a significant risk as it undermines the integrity of time-based access controls, potentially exposing sensitive resources to unauthorized access.
How To Fix
Minimum fixed version
26.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can implement additional logging and monitoring of authorization requests to detect any suspicious activity related to time manipulation. Additionally, consider enforcing stricter validation of time-related claims in authorization requests until the package is updated.
Conclusion
The CVE-2026-18572 vulnerability in Keycloak poses a significant risk by allowing users to bypass time-based access controls. It is crucial for administrators to update to the patched version and implement monitoring to safeguard against unauthorized access.
See every vulnerability recorded for keycloak →
FAQ
CVE-2026-18572 is a vulnerability in the Keycloak package that allows users to override time-based authorization policies, potentially granting unauthorized access to protected resources.
If your application uses Keycloak for authorization, this vulnerability could allow users to bypass time-based access controls, leading to unauthorized access to sensitive resources.
You should update your Keycloak package to version 26.7.3 or later to mitigate the vulnerability. Additionally, consider implementing monitoring to detect any unauthorized access attempts.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without needing to sign up.
Failing to address this vulnerability could lead to unauthorized access to sensitive resources, which may result in data breaches, compliance issues, and damage to your organization's reputation.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak.
