CVE-2026-1035
Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition
- State
- Published
- Severity
- 3.1 Low
- Published
- Jan 21, 2026
- Updated
- Apr 2, 2026
- Reserved
- Jan 16, 2026
Description
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N | redhat |
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.11Red Hat | |
Red Hat JBoss Enterprise Application Platform 8Red Hat | |
Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- RHSA-2026:6477vendor-advisory
- RHSA-2026:6478vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1035vdb-entry
- RHBZ#2430314issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.