Gyeongpyo Son

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists when `revokeRefreshToken=true` is enabled and persistent session storage is utilized. A server restart can reset internal timing mechanisms, allowing a remote attacker who has captured a user's refresh token to replay it after revocation. This can result in unauthorized account access, information disclosure, or privilege escalation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.