The vulnerability arises when both realm‑level and client‑level notBefore revocation policies are configured in Keycloak. The OpenID Connect (OIDC) introspection endpoint fails to honor the realm‑level policy under these conditions, allowing tokens that should have been revoked to remain valid. This flaw, classified as CWE‑303, enables an attacker to maintain unauthorized access or prolonged session validity.

Red Hat Build of Keycloak is affected. Specific product names are Keycloak services; no exact version information is provided in the advisories. Operators of Red Hat Keycloak deployments should review their configuration for the presence of overlapping revocation policies.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the OIDC introspection endpoint, which may be accessed by clients or attackers who can query token states. If an attacker can invoke introspection or otherwise learn token status, they can effectively bypass revocation, leading to continued access. In the absence of a vendor patch, the risk remains moderate until an update or configuration change mitigates the issue.