CVE-2026-18218 is a moderate severity vulnerability in Keycloak's TokenManager component. When an administrator tries to revoke tokens for a particular client using a "not-before" policy, the revocation can be silently ignored if the security realm already has an older, non-zero revocation policy. This logic error in the TokenManager.NotBeforeCheck function causes client-specific revocation policies to be bypassed in favor of the older realm-level policy. As a result, tokens previously issued may continue to be used for session refresh, introspection, and accessing user information even after revocation attempts. Exploitation requires low privileges but a specific pre-existing realm configuration and possession of valid tokens. Red Hat's advisory confirms no current mitigation or fix meets their criteria for deployment.

The vulnerability allows attackers who possess valid tokens and have knowledge of a specific realm configuration to continue using revoked tokens for refreshing sessions, introspection, and accessing user information. This leads to unauthorized access to sensitive data and potential privilege escalation by bypassing intended token revocation controls. The impact is limited to confidentiality and integrity with no availability impact. Exploitation complexity is high due to required conditions, and no known exploits are reported in the wild.

According to the Red Hat advisory, no effective mitigation or patch is currently available that meets criteria for ease of use, deployment, or applicability. Administrators should be aware of the issue and monitor vendor communications for future fixes. Until a fix is released, cautious management of token revocation policies and minimizing token exposure are advisable, but no direct mitigation is provided by the vendor.