Low severity · published Jan 21, 2026
CVE-2026-1035
Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1035
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:6477
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:6478
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-1035
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2430314
More from Red Hat build of Keycloak 26.4
9.8
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
9.1
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
9.1
CVE-2026-16443
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
8.8
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
8.8
CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt