Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
RedHat CVE advisory released a security advisory ( CVE-2026-97846 ) .
Feedly found the first article mentioning CVE-2026-97846 . See article
NVD published the first details for CVE-2026-97846
GitHub Advisories released a security advisory .
Links to Mitre Att&cks
CVE-2026-97846 - Exploits & Severity - Feedly
CVE-2026-97846: Improper Authentication in Red Hat Red Hat Build of Keycloak
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
