The User Session Note mapper in Red Hat Build of Keycloak fails to validate whether a requested session note contains sensitive internal credentials; the vulnerability is a classic example of CWE‑200, Information Exposure. Because of this flaw, a delegated client administrator can retrieve federation access tokens from external identity providers and include them in the tokens issued to their managed applications. This exposure of upstream bearer tokens can give the attacker unauthorized access to the user’s data on external platforms and results in a confidentiality breach.

The vulnerability affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific affected versions are listed, so all builds of these products could be impacted until a vulnerability fix is released.

The CVSS score of 5.7 indicates a medium severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, which suggests a lower public exploitation probability at present. The attack requires that the adversary be a delegated client administrator with sufficient rights to request session notes; once able, the attacker can pull upstream tokens and embed them in application tokens. Even though the attack surface is limited to privileged users, leaking these tokens can lead to attacker‑owned impersonation of the user on external services.