AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2026-1035

LOW · CVSS 3.1 EPSS 0.28%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-01-21 · Last synced 2026-08-04

CyberRota Analysis

This is a low severity vulnerability with a CVSS score of 3.1. See the original NVD description below for full technical details.

CVE
CVE-2026-1035
Severity
LOW
CVSS
3.1
EPSS
0.28%

Original NVD Description

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.