vulnerability in Keycloak mTLS feature allowing unauthorized token access
CVE-2026-97846

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
25 September 2026

What is CVE-2026-97846?

Keycloak's mTLS holder-of-key binding feature is designed to ensure that tokens can only be used by the original client that requested them. However, a flaw has been identified in the new Standard Token Exchange V2 feature which neglects to validate the client's digital certificate. This oversight permits attackers with compromised client credentials to exploit the system and acquire a standard, unrestricted token, effectively bypassing the intended security controls.

References

https://access.redhat.com/security/cve/CVE-2026-97846
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2540949
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.