CVE-2026-93999

Overview

A logic flaw exists in the OIDC token refresh implementation within Keycloak. The system fails to verify whether a target audience client remains enabled when restoring requested audiences from stored client IDs. This allows valid access tokens to continue being issued for disabled clients during the refresh cycle.

Description

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

Impact

Confidentiality and integrity may be impacted if resource servers rely on offline JWT validation without checking current client status. Authenticated clients holding existing refresh tokens can bypass administrative access controls intended to restrict disabled applications. Organizations utilizing Keycloak for identity and access management are affected.

Remediation

Apply the official security update or patch provided by the Keycloak maintainers once available. Review identity provider configurations and monitor token refresh activity for anomalies involving disabled client IDs. Ensure resource servers implement online token introspection or verify active client status where feasible rather than relying solely on offline JWT validation.

Risk context

The vulnerability is rated with a medium severity and a CVSS base score of 4.2, indicating a moderate risk to authorization controls. Defenders should prioritize patching during standard maintenance cycles while evaluating reliance on offline token validation.

Affected products

• Keycloak