Keycloak exposes a flaw that permits an attacker, after a server restart, to reuse a refresh token that was previously revoked under the revokeRefreshToken setting when persistent session storage is enabled. This replay grants the attacker unauthorized access to the victim’s account, potentially resulting in information disclosure or privilege escalation. The weakness is a misuse of session validity logic, classified as CWE‑613.

Red Hat Build of Keycloak. No specific version range is documented in the available data, so all installations that use the Red Hat build of Keycloak with the vulnerable configuration should be considered at risk.

The CVSS base score of 6.8 indicates a medium impact severity. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that publicly known attacks are not yet confirmed. However, the attack scenario is remote and requires only a previously captured refresh token, making it potentially feasible if the attacker has observed traffic or stored token artifacts. The lack of an identified public exploit means the threat is still theoretical but not negligible, especially in environments where user sessions are long‑lived or refreshed across cluster restarts.