A flaw in the OIDC Dynamic Client Registration (DCR) component of Keycloak causes the backchannel logout offline token revocation setting to be omitted from responses during client updates. This omission silently disables the setting, potentially allowing offline tokens to remain valid after a user session is terminated via backchannel logout. The issue has a medium severity rating and a CVSS score of 4.3.