CVE-2026-93999

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the OpenID Connect (OIDC) protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the target audience client remains enabled before issuing a new access token. This allows an application holding a refresh token to obtain valid access tokens for a disabled client, which may bypass administrative access controls for resource servers using offline JSON Web Token (JWT) validation—a method where the server validates the token locally without contacting the identity provider.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.