CVE-2026-1035

The record

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.

Affected packages

Related vulnerabilities

• GHSA-m2w5-7xhv-w6fh Keycloak does not validate and update refresh token usage atomically Same vulnerability
• GHSA-7g5x-9c4v-4w5r Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass Also affects org.keycloak:keycloak-services
• CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component. Also affects org.keycloak:keycloak-services
• GHSA-fjf4-6f34-w64q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol Also affects org.keycloak:keycloak-services
• CVE-2026-2733 A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens… Also affects org.keycloak:keycloak-services
• GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens Also affects org.keycloak:keycloak-services
• GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation Also affects org.keycloak:keycloak-services
• GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the… Also affects org.keycloak:keycloak-services