A vulnerability in the TokenManager component of Keycloak allows token revocation attempts for specific clients to be silently ignored if the realm has an older, non-zero revocation policy. This flaw permits previously issued tokens to remain valid, enabling session refresh and access to user information despite administrative revocation attempts. The issue is tracked as CVE-2026-18218 with a medium severity score of 4.2. Red Hat has released fixed versions in Keycloak 26.6.7 images for OpenShift deployments.