Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-107623 EUVD-2026-95034GHSA-qxj8-968q-qm7w

Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

Published Oct 8, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Description

A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.8 — —
Red Hat Red Hat Single Sign-On 7 — —

Advisories 1

References