VulnSocial

CVE-2026-93999Disclosure

LOWCVSS 4.2 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-09-19); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-19: 2Mentions · 2026-10-27: 1Patch / Workaround · 2026-10-27: 1Technical Details · 2026-09-19: 2Technical Details · 2026-10-27: 109-1910-27
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-192
Disclosure2
2026-10-271
Disclosure1
Full discourse3 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Disclosure

    CVE-2026-93999 Keycloak OIDC flaw: disabled clients still get refreshed access tokens, risking auth bypass. CVSS 4.2, unpatched. Review configs and patch now. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-93999 #Keycloak #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses a Keycloak OIDC vulnerability (CVE-2026-93999) involving authentication bypass via token refresh for disabled clients, providing technical details (CVSS 4.2) and noting the issue is currently unpatched while urging configuration review and patching.

    0000037
    1.1K followersView on X
  • Severity Daily@severitydaily
    Disclosure

    Disabling a Keycloak client does not stop its tokens. Refresh keeps minting access tokens that name the disabled client, Red Hat (@RedHat) disclosed today, with two more admin bypasses. No fix yet. https://severitydaily.com/keycloak-cve-2026-93999-disabled-client-refresh-tokens-fgap-admin-bypasses-no-fix/

    Post summary

    The tweet discloses a Keycloak vulnerability (CVE-2026-93999) with technical details about token bypass and admin vulnerabilities, noting that no patch is currently available.

    0000034
    24 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-93999 A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh pr… https://www.cve.org/CVERecord?id=CVE-2026-93999

    Post summary

    The text discloses CVE-2026-93999, describing a flaw in Keycloak's OIDC protocol implementation during token refresh, but provides no evidence of active exploitation, PoC code, named exploits, patches, or workarounds.

    00000968
    58.1K followersView on X

Explore more

Back to dashboard