NIXPKGS-2026-0076
GitHub issue
published on 21 Jan 2026
by @LeSuisse Activity log
- Created automatic suggestion
-
@LeSuisse
removed
4 packages
- terraform-providers.keycloak
- python312Packages.python-keycloak
- python313Packages.python-keycloak
- terraform-providers.keycloak_keycloak
- @LeSuisse accepted
- @LeSuisse published on GitHub
Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Affected products
keycloak
- <26.4.3
keycloak-server
rhbk/keycloak-rhel9
- *
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
Red Hat build of Keycloak 26.2.11
Package maintainers
-
@leona-ya Leona Maroni <nix@leona.is>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>