A vulnerability was found in Keycloaks Standard Token Exchange V2 implementation within the org.keycloak.protocol.oidc.tokenexchange package. The root cause is that exchanged tokens are issued with a new access-token lifetime derived from the requester clients configuration, failing to bound the new tokens expiration by the subject tokens original expiration time.
For service accounts which lack a session ID, this creates a chain where a requester client can indefinitely refresh access by performing a new exchange before the current token expires. The vulnerability persists even if an administrator disables the origin client, as Keycloak continues to accept exchanges of previously exchanged tokens associated with the requester client. An attacker with a valid service-account token and the requester clients credentials can maintain persistent, unauthorized access to resources beyond the intended security lifecycle.