CVE-2026-18572

6.5 mediumEPSS 0.4%

Medium (6.5) in redhat build of keycloak. EPSS 0.4% chance of exploitation in the next 30 days.

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-08-02
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

Affected

redhat:build_of_keycloak

References

https://access.redhat.com/errata/RHSA-2026:68277
https://access.redhat.com/errata/RHSA-2026:68278
https://access.redhat.com/security/cve/CVE-2026-18572
https://bugzilla.redhat.com/show_bug.cgi?id=2509763

Check your stack JSON