CVE-2026-18572 – Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

CVE ID :CVE-2026-18572

Published : Aug. 2, 2026, 6:16 a.m. | 1 hour, 35 minutes ago

Description :Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.

Severity: 6.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…