Repository navigation
[CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set #49118
Description
Description
When a realm-level notBefore revocation is applied (e.g., via global logout or the "Not Before" revocation policy), the OIDC token introspection endpoint still returns active=true for tokens issued before the realm cutoff, if the client also has a client-level notBefore value configured. The client-level notBefore takes precedence instead of using the more restrictive of the two values.
This causes resource servers that rely on introspection to continue honoring tokens that should have been invalidated by the realm-wide revocation.
Version affected
All current versions.
Expected behavior
When both realm-level and client-level notBefore values are set, token introspection should use the more recent (higher) of the two values. A token issued before the realm-level notBefore cutoff should be reported as active=false, regardless of the client-level notBefore value.
Actual behavior
Token introspection evaluates only the client-level notBefore value when it is present, ignoring the realm-level notBefore. Tokens issued before the realm-level revocation cutoff are returned as active=true if they were issued after the client-level notBefore.
Steps to reproduce
- Authenticate as a user or client and obtain a valid access token
- Set a client-level
notBeforevalue on the client (e.g., via "Not Before" in the client settings) - Advance the realm-level
notBeforeby triggering a realm-wide revocation (e.g., global logout or setting the realm "Not Before" policy to the current time) - Call the OIDC introspection endpoint with the token obtained in step 1
- Observe that the response returns
active=true, even though the token was issued before the realm-levelnotBeforecutoff
This issue was originally tracked in the private repository. Migrated by @abstractj.
Activity
fix not before validation
21 remaining items
fix not before validation