5.4 Medium

CVE-2026-96460 Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2

Description

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Build of Keycloak	Versions not published
Red Hat Single Sign-On 7	Versions not published
Red Hat build of Keycloak 26.6.8	Versions not published

References

RHSA-2026:95761 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2539301 bugzilla.redhat.com

Timeline

Published November 6, 2026
Last modified November 6, 2026

The 276 CVEs of Red Hat Build of Keycloak →

CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Medium CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Medium CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Medium CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Medium

Track this CVE