Keycloak's authorization service supports time-based policies to restrict resource access during specific periods. The vulnerability arises because the system accepts a user-supplied time value in authorization requests, which can override the actual server time. This incorrect authorization logic enables an attacker with at least low privileges to bypass time-based access controls and gain unauthorized access to resources. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level is currently indicated in the vendor advisory. The vendor advisory URL is provided but does not explicitly confirm patch availability or mitigation steps.

An attacker with some privileges can bypass time-based access restrictions by manipulating the time value in authorization requests. This leads to unauthorized modification or interaction with protected resources outside allowed time frames, impacting the integrity of the system. There is no reported impact on confidentiality or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18572 for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting time-based authorization policies if feasible or implement additional monitoring to detect anomalous access patterns related to time manipulation.