CVE-2026-1035 is a flaw in the Keycloak server's refresh token processing, specifically within the TokenManager class, that undermines strict refresh token rotation. When this hardening is enabled, concurrent refresh requests can bypass single-use enforcement due to non-atomic validation and updates, allowing multiple access tokens to be issued from a single refresh token. This vulnerability has a low CVSS score of 3.1, indicating a low impact of partial integrity loss with high attack complexity and requiring low privileges. There is no evidence of active exploitation, no known exploit code available, and it is not listed in the KEV catalog, though it has garnered significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Red Hat | Red Hat Build Of Keycloak 26.4 | Range not provided by sourceCNA affecteddefault affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.