Medium [CVE-2026-18572] UMA claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time.

This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to be an authenticated user and the target resource must be specifically protected by a time-based authorization policy.

Successful exploitation allows an attacker to bypass temporal access controls and obtain permissions outside of allowed time windows. The vulnerability's root cause is the improper merging of user-supplied claims which allows them to overwrite trusted server-side evaluation attributes.

Weakness: CWE-863. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7.

Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.