The vulnerability in Red Hat build of Keycloak 26.4 involves incorrect implementation of token revocation policies in the OpenID Connect Introspection feature. Specifically, when both realm-level and client-level 'notBefore' revocation policies are configured, the realm-level policy is not properly honored, allowing tokens that should be revoked to remain active. This could lead to unauthorized access or continued session validity in systems relying on Keycloak for identity and access management. Red Hat's security advisories for Keycloak 26.6.3 include this vulnerability among several others fixed in the updated images. The advisories do not specify a separate patch for this CVE but recommend upgrading to the 26.6.3 release. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low complexity, requiring low privileges, no user interaction, and impacts confidentiality and integrity.

Tokens that should have been revoked due to realm-level 'notBefore' policies may remain valid, potentially allowing unauthorized access or continued session validity. This undermines the security of authentication and authorization processes in affected Keycloak deployments. The impact is limited to confidentiality and integrity, with no direct availability impact reported. No known exploits in the wild have been reported.

Red Hat has released updated Keycloak 26.6.3 images that address this vulnerability along with other security issues. Users should upgrade to Red Hat build of Keycloak 26.6.3 as provided in the official Red Hat Customer Portal advisories RHSA-2026:25097 and RHSA-2026:25098. Before applying the update, back up existing installations including applications, configuration files, and databases. No separate patch for CVE-2026-8922 alone is provided; remediation is via upgrading to the fixed 26.6.3 version. Monitor Red Hat advisories for any further updates.