Keycloak OpenID Connect Introspection Revocation Policy Bypass Vulnerability

A vulnerability exists in Keycloak's OpenID Connect (OIDC) Introspection feature. When both realm-level and client-level 'notBefore' revocation policies are set, the introspection feature does not properly respect the realm-level policy. This oversight allows revoked tokens to remain active, potentially leading to unauthorized access or continued session validity. This issue affects systems using Keycloak for identity and access management.

Impact

This vulnerability allows revoked OIDC tokens to remain active, creating a temporary bypass of security controls and potentially leading to unauthorized access or extended session validity.