A flaw in Keycloak’s TokenManager validates stateless access tokens by falling back to the preferred_username when the original user ID no longer exists. This represents a CWE‑287 weakness—authentication bypass—that occurs because the username is accepted without verifying that it matches the token’s subject. An attacker who holds an old token can use it to gain access to a new service account that shares the same client ID as the previously deleted account, resulting in unauthorized access to resources protected by that account.

The vulnerability affects Keycloak, the open‑source identity and access management platform. The issue exists in any version where the TokenManager component performs the described fallback. No specific version numbers are supplied by the CNA; it is reasonable to assume that all releases that include this component are potentially susceptible until a fixed version is released.

The CVSS score of 4.2 indicates a medium severity metric, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote: an attacker must possess a valid old stateless access token that references a user ID that no longer exists. If that token is applied to a newly created service account with a matching client ID, the token will be accepted. The exploitation does not require privileged local access but does require the prior acquisition of a token that would normally be expired or orphaned. Although the defect is not currently exploited in the wild, the combination of token reuse and client ID re‑use creates a realistic risk of unauthorized service‑level access.