Keycloak services provide time‑based access restrictions, allowing administrators to limit resource access to specific hours. The vulnerability allows a user to supply a fabricated time value in an authorization request that overrides the server’s actual timestamp, effectively bypassing the time restrictions and granting access to protected resources at unauthorized times. This flaw manifests as an authorization bypass (CWE‑863).

Affected products include Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. All versions prior to the published fix are vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the extremely low EPSS score (< 1%) suggests that exploitation is unlikely, and it is not currently listed in the CISA KEV catalog. The likely attack vector requires the attacker to control or forge UMA claim tokens in an authorization request; such a token can override the server time, allowing the attacker to access resources during blocked windows. The risk is moderate in environments that rely heavily on time‑based restriction enforcement.