Description
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | keycloak versions prior to 18.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.6-1.redhat_00002.1.el7sso | RHSA-2022:1712, RHSA-2022:1711 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 18.0.0 | 18.0.0 | GHSA-75p6-52g3-rqc8 |
Advisories 3
- RHSA-2022:1712 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2022:1711 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 22, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026