CVE-2026-18218 is a logic flaw in the TokenManager.NotBeforeCheck function of Red Hat Build of Keycloak. When an administrator tries to revoke tokens for a client using a "not-before" policy, the revocation may be ignored if the realm-level not-before policy is older but non-zero. This causes client-specific token revocations to be ineffective, allowing previously issued tokens to remain valid for refresh, introspection, and UserInfo requests. The issue arises from improper enforcement of client-specific revocation policies when a realm-level policy exists. Exploitation requires possession of valid tokens and a particular realm configuration. Red Hat rates this vulnerability as moderate severity and has not provided a patch or effective mitigation at this time.

An attacker with valid tokens issued within a specific timeframe and under a specific realm configuration can continue to use revoked tokens to refresh sessions and access user information. This results in confidentiality and integrity impacts by allowing unauthorized access and modification of application data. The vulnerability does not impact availability. The overall severity is medium (CVSS 4.2).

Currently, no mitigation or patch meeting Red Hat Product Security criteria for ease of use, applicability, and stability is available. Administrators should monitor Red Hat advisories for updates. No immediate action is recommended by Red Hat beyond awareness of the issue.