EUVD-2026-86530
GHSA-f7cv-8449-mr73
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Network token endpoint (AV:N); AC:H and PR:L because attacker needs stolen client credentials plus a deployment using Token Exchange V2 and mTLS binding; bypassed token grants confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
AnalysisAI
mTLS holder-of-key certificate binding is not enforced in Keycloak's Standard Token Exchange V2 flow, so an attacker who already holds valid confidential client credentials can obtain a standard, unrestricted token that escapes the certificate-binding protection the deployment believed was in place. Affected distributions include Red Hat Build of Keycloak and Red Hat Single Sign-On 7, and exploitation is conditional on three things being true at once: the attacker must already possess a stolen client secret or key (the CVSS vector rates this PR:L - a precondition the flaw itself does not grant), the deployment must have Standard Token Exchange V2 enabled and in active use, and the deployment must be relying on mTLS holder-of-key binding as a hardening control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the attacker already possesses valid confidential client credentials (PR:L - a stolen client secret or key, not something obtainable through this flaw); (2) the Keycloak/Red Hat SSO deployment has the new Standard Token Exchange V2 feature enabled and in use; and (3) the deployment relies on mTLS holder-of-key certificate binding as a protection, since the flaw is that V2 fails to enforce that certificate check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional security-control-bypass, not a mass-exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, so remediation is currently compensating-control based until Red Hat publishes fixed builds through https://access.redhat.com/security/cve/CVE-2026-97846 and https://bugzilla.redhat.com/show_bug.cgi?id=2540949. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today