Authentication mechanism absence or evasion In org.keycloak:keycloak-services
Description
Keycloak services allows the issuance of access and refresh tokens for disabled users A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 26.5.2, 26.4.9 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5.