A timing race condition exists in Keycloak’s TokenManager when strict refresh token rotation is enabled. The validation and update of a token’s usage are not performed atomically, allowing multiple concurrent refresh requests to bypass the single‑use rule and receive several new access tokens from the same refresh token. This flaw does not provide code execution or remote access, but it allows an attacker who has a valid refresh token to generate unlimited access tokens, effectively extending the lifetime of compromised credentials.

Red Hat JBoss Enterprise Application Platform 8, the Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign‑On 7, and the Red Hat builds of Keycloak 26.4—including 26.4.11—are all affected when strict refresh token rotation is active. Systems running these products need to verify their configuration and version.

The CVSS base score of 3.1 indicates a low severity vulnerability, and the EPSS score is below 1 %, meaning exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must already possess a valid refresh token and be able to issue multiple simultaneous refresh requests to trigger the race condition. Since the impact is limited to the issuance of additional access tokens, the risk is confined to environments where refresh tokens are exposed or reused; broader system compromise is not possible.