A flaw in the Pushed Authorization Request implementation within keycloak-services permits an attacker to trigger a flow restart that mistakenly resets the internal flags that mark a request as consumed while leaving the request authenticated. The result is that the same authorization request can be replayed to obtain multiple access tokens, violating the expected single-use behavior and potentially granting repeated or broadened access to protected resources. This weakness is classified as CWE-670.

Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are affected. No specific version information was supplied, so any deployed instance of these products with the impacted keycloak-services component is potentially vulnerable.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation has been observed or reported. However, the exploitation requires an attacker to obtain an initial authorization request and then trigger a flow restart, which can likely be performed over the network through normal authentication flows. Once triggered, the attacker can repeatedly acquire access tokens without re-authenticating, compromising the confidentiality and integrity of the protected resources authorized by the original request.