Listen to this Post
The vulnerability resides in the TokenManager class within the Keycloak server’s refresh token processing logic. When strict refresh token rotation is enabled, the server is designed to allow each refresh token to be used only once to obtain a new access token, after which the refresh token is invalidated and a new one is issued. However, the validation of the refresh token’s usability and the subsequent update of its state to “used” are performed as separate, non-atomic operations. This creates a race condition window. If an attacker or client submits multiple concurrent refresh requests using the same refresh token, each request thread can independently check the token’s validity before any thread updates its status. All concurrent threads may find the token still valid, thereby each successfully issuing a new access token before the token is marked as consumed. This flaw effectively bypasses the single-use enforcement, undermining the refresh token rotation security feature. The non-atomic sequence involves reading the token state, checking against reuse policies, and then writing the updated state, without adequate locking or transactional boundaries to prevent interleaving in concurrent environments.
Platform: Keycloak
Version: Not specified
Vulnerability: Atomic validation flaw
Severity: Low
Date: Jan 21, 2026
Prediction: Patch TBA
What Undercode Say:
Analytics
curl -X POST $KEYCLOAK_URL/token \ -d 'grant_type=refresh_token&refresh_token=<TOKEN>' & curl -X POST $KEYCLOAK_URL/token \ -d 'grant_type=refresh_token&refresh_token=<TOKEN>' & watch -n 1 'tail -f $KEYCLOAK_LOG | grep "Refresh token"'
how Exploit:
Send concurrent refresh requests.
Protection from this CVE
Apply vendor patch.
Impact:
Undermines token rotation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
