CVE detail
CVE-2026-8922
A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens that should have been revoked to remain active, potentially leading to unauthorized access or continued session validity. This could impact the security of systems utilizing Keycloak for identity and access management.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 19.5 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
6 source links · newest first
- https://bugzilla.redhat.com/show_bug.cgi?id=2479586bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMay 19, 2026, 8:16 AM - https://access.redhat.com/security/cve/CVE-2026-8922access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 19, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:30050access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 19, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:30049access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 19, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:25098access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 19, 2026, 8:16 AM - https://access.redhat.com/errata/RHSA-2026:25097access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 19, 2026, 8:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66028CVSS 7.1 · High
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts…
- CVE-2026-57852CVSS 6.3 · Medium
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a…
- CVE-2026-47300CVSS 8.8 · High
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- CVE-2026-50360CVSS 8.8 · High
Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-41053CVSS 8.8 · High
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13…
- CVE-2026-12773CVSS 5.5 · Medium
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_m…