This vulnerability arises from an incorrect implementation of the authentication algorithm in Red Hat's build of Keycloak. Specifically, when both realm-level and client-level 'notBefore' revocation policies are set, the OpenID Connect Introspection feature fails to honor the realm-level policy properly. As a result, tokens that should be invalidated remain active, which could compromise the security of systems relying on Keycloak for identity and access management. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

The impact is that tokens which should have been revoked due to the realm-level 'notBefore' policy remain valid, potentially allowing unauthorized access or continued session validity. This could lead to unauthorized users maintaining access to protected resources or services that rely on Keycloak for authentication and authorization. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-8922 for current remediation guidance. No explicit patch or workaround is currently documented in the provided advisory content. Users should monitor Red Hat's official channels for updates and apply any released fixes promptly once available.