Bug 2539301 (CVE-2026-96460)

Summary: CVE-2026-96460 keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-21   

Description OSIDB Bzimport 2026-09-23 09:59:06 UTC 
A vulnerability was found in Keycloaks Standard Token Exchange V2 implementation within the org.keycloak.protocol.oidc.tokenexchange package. The root cause is that exchanged tokens are issued with a new access-token lifetime derived from the requester clients configuration, failing to bound the new tokens expiration by the subject tokens original expiration time.
For service accounts which lack a session ID, this creates a chain where a requester client can indefinitely refresh access by performing a new exchange before the current token expires. The vulnerability persists even if an administrator disables the origin client, as Keycloak continues to accept exchanges of previously exchanged tokens associated with the requester client. An attacker with a valid service-account token and the requester clients credentials can maintain persistent, unauthorized access to resources beyond the intended security lifecycle.