Medium 5.4

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange...

CVE-2026-96460 First seen on SecPulse Nov 6, 10:05

Original description The description as published by the source.

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.

Source: Red Hat Security Advisories NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.4; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published: Nov 6, 2026
First seen on SecPulse: Nov 6, 10:05
GHSA: GHSA-pfrc-rpch-683c
CWE: CWE-303

NVD GitHub Advisory

Tags(click for explanation)

Operating Systems

RHEL

CWE

CWE-303

Vendors

Red Hat

All

Red Hat Build Of Keycloak Red Hat Single Sign On 7 Red Hat Build Of Keycloak 2668 Red Hat Build Of Keycloak 266

Detection sources

NIST National Vulnerability DatabaseNov 10, 14:18
GitHub Security Advisories (Global)Nov 7, 03:36
Red Hat Security AdvisoriesNov 6, 10:05
CVE.org (CVE Program・cvelistV5)Nov 10, 13:49