Keycloak can authenticate users via Google accounts and enforce a restriction that only users from a specific Google Workspace domain are allowed. The vulnerability lies in the token exchange feature, which permits swapping a received Google token for a Keycloak token without re‑checking the domain restriction. As a result, an attacker possessing a valid Google account that belongs to a different domain can acquire a Keycloak token and gain unauthorized access to the realm. The weakness is a missing authorization check, classified as CWE-862.

The flaw affects Red Hat Build of Keycloak, Red Hat Single Sign‑On 7, Red Hat Data Grid 8, and the JBoss Enterprise Application Platform Expansion Pack as distributed by Red Hat. No specific affected versions are listed in the CNA data, so all currently supported releases should be considered vulnerable until a patch is applied.

The CVSS score of 6.8 indicates a moderate severity for this missing protection. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting that there are no known active exploits in the wild yet. The likely attack path requires an attacker to create or obtain a Google account outside the allowed domain and then use this account to perform a token exchange request to the vulnerable endpoint. Because the check is performed at token exchange time, the attacker can bypass the domain restriction without further privileges.