Back cve.report

CVE-2026-97846 CVE Vulnerability Disclosures / 21h Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

cve.report • September 26, 2026

CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Keycloak CVE-2026-97846 Exposes Token Security A vulnerability identified as CVE-2026-97846 in Keycloak's Standard Token Exchange V2 feature allows attackers with stolen client credentials to bypass mTLS holder-of-key binding protections. This flaw enables the acquisition of unrestricted Bearer tokens, potentially leading to unauthorized access to sensitive resources. The vulnerability is rated as moderate due to the requirement for valid client credentials and specific configurations for exploitation. Currently, no effective mitigation or fix is available, and organizations are advised to monitor Red Hat advisories for updates. The vulnerability impacts confidentiality and integrity but does not affect system availability. Exploitation complexity is high, requiring significant effort and specific conditions. Keycloak users are urged to limit credential exposure and review configurations to reduce risk until a patch is released. 5 sources 53

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)