CVE-2026-18572

CVE-2026-18572 is an authorization bypass in Keycloak where a client can submit a time parameter that the server uses in its authorization decision. This isn't a logic error—it's a design flaw where time became a client-controllable input to a security-critical check. An attacker can forge the timestamp to access resources outside their permitted time windows, bypass session expiry controls, or manipulate token validation windows. The immediate priority: verify your Keycloak version against the affected release and apply the patch. But the deeper question is whether the fix removes the parameter entirely or merely sanitizes input. If it's sanitization, the underlying API contract still permits client-supplied time—meaning this vulnerability class remains exploitable through alternate paths. Check the patch commit to confirm the parameter is removed from the authorization endpoint, not just validated. Beyond this specific endpoint, audit your Keycloak deployment for other client-controllable parameters in the authorization pipeline—particularly in permission ticket evaluation, scope translation, and policy caching. The pattern of exposing internal state as API parameters is the real architectural smell here. The severity exceeds what the 6.5 CVSS suggests. If Keycloak timestamps feed into your SIEM, compliance logging, or cross-system correlation, a forged timestamp doesn't just bypass access controls—it poisons your audit trail. Your forensic data becomes unreliable, and compliance attestations signed by Keycloak timestamps may need re-evaluation. This is a trust-chain corruption issue, not merely an access bypass. If you're running Keycloak in clustered mode, verify that the fix addresses time authority at the cluster level—removing a client parameter doesn't help if admin endpoints or clustering protocols still allow time injection.

Reviewed through automated stages and approved by a human before publication.