Keycloak's authorization services allow administrators to restrict resource access based on time policies. The vulnerability arises because user-supplied claims can improperly overwrite trusted server-side evaluation attributes, specifically the time value used for authorization decisions. This incorrect authorization flaw (CWE-863) enables an authenticated user to bypass temporal access controls by injecting a fake time value in their authorization request, thereby gaining access to resources at unauthorized times. The issue does not affect confidentiality but impacts integrity by allowing unauthorized modification or access to protected data. Exploitation requires authenticated user privileges and a resource protected by time-based policies. No known exploits are reported in the wild. Red Hat has assessed the severity as moderate with a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

An authenticated attacker can bypass time-based access restrictions to gain unauthorized access to protected resources outside the intended time windows. This can lead to unauthorized modification or access to sensitive data and potentially elevated privileges within the application. There is no direct impact on confidentiality or availability reported. Exploitation requires the attacker to have valid credentials and the target resource to be protected by time-based authorization policies.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18572 for current remediation guidance. Until a fix is available, administrators should review and potentially tighten time-based authorization policies and monitor for unusual access patterns. No vendor-provided mitigations or temporary fixes are currently documented.