Keycloak Refresh Token Replay Vulnerability After Server Restart

A vulnerability in Keycloak allows a remote attacker to replay a user's refresh token, even after it has been revoked, under certain conditions. This issue arises when the 'revokeRefreshToken' option is enabled and persistent session storage is used. After a server restart, internal timing mechanisms can be reset, enabling the replay of previously captured refresh tokens. Successful exploitation of this vulnerability grants unauthorized access to the victim's account, which could lead to information disclosure or privilege escalation.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, with potential consequences including information disclosure or privilege escalation.