Keycloak’s token exchange mechanism has an authorization flaw that causes it to issue new tokens with lifetimes derived solely from the requester client’s settings, rather than clamping the lifetime to the original token’s expiration. An authenticated requester can repeatedly request token exchanges to extend a service account’s access indefinitely, even after the original client is disabled by an administrator. This flaw effectively bypasses normal authorization controls and allows continued privileged access over an extended period.

The vulnerability affects the Keycloak service. No specific vendor or product version information is provided in the CVE data, so all Keycloak deployments that include the Standard Token Exchange V2 functionality and do not apply the official fix are potentially vulnerable.

The CVSS score of 5.4 indicates a moderate security impact. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is no widespread active exploitation yet. The likely attack vector is remote authenticated; an attacker who can obtain a valid access token can exploit the issue by repeatedly requesting Standard Token Exchange V2 requests. The problem does not allow code execution, but it enables persistent expansion of a service account’s privileges, which can lead to sustained unauthorized access and data exfiltration.