CVE-2026-96460Medium· 5.4▾ SunlitA flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
keycloak-services (all versions)rhbk/keycloak-rhel9 (all versions)keycloak-servicesRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109081Medium· 6.8Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint
CVE-2026-107124Medium· 6.4Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover
CVE-2026-96447Medium· 4.2Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding
CVE-2026-19688Medium· 6.8Keycloak-services: keycloak-services: admin api missing audience check
CVE-2026-96547Medium· 6.5Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
CVE-2026-97367Medium· 6.4Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover