CVE-2026-97846: Improper Authentication in Red Hat Red Hat Build of Keycloak Radar - Latest Security Threats / 14h Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestr

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

Keycloak's mTLS holder-of-key binding feature ensures tokens are bound to the client's digital certificate, preventing token misuse. However, the Standard Token Exchange V2 feature does not verify this certificate, enabling attackers with stolen client credentials to bypass mTLS constraints and obtain unconstrained Bearer tokens. The root cause is a missing enforcement check for client certificates in the Standard Token Exchange V2 grant provider. Red Hat rates this vulnerability as moderate severity due to the prerequisite conditions for exploitation and the impact of bypassing sender constraints.

Successful exploitation allows an attacker who already has valid client credentials and a valid subject token to bypass mTLS sender-constraints and obtain unrestricted Bearer tokens. This can lead to unauthorized access to protected resources and elevated privileges within the affected system. The vulnerability impacts confidentiality and integrity but does not affect availability.

Mitigation Recommendations

As per the Red Hat advisory, no mitigation or fix currently meets the criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since exploitation requires valid client credentials and specific configurations, limiting credential exposure and reviewing configurations may reduce risk until a fix is available.

Mitigation Recommendations

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

Red Hat Build of Keycloak

Red Hat Single Sign-On 7

Machine-generated threat intelligence

Keycloak's mTLS holder-of-key binding feature ensures tokens are bound to the client's digital certificate, preventing token misuse. However, the Standard Token Exchange V2 feature does not verify this certificate, enabling attackers with stolen client credentials to bypass mTLS constraints and obtain unconstrained Bearer tokens. The root cause is a missing enforcement check for client certificates in the Standard Token Exchange V2 grant provider. Red Hat rates this vulnerability as moderate severity due to the prerequisite conditions for exploitation and the impact of bypassing sender constraints.

Successful exploitation allows an attacker who already has valid client credentials and a valid subject token to bypass mTLS sender-constraints and obtain unrestricted Bearer tokens. This can lead to unauthorized access to protected resources and elevated privileges within the affected system. The vulnerability impacts confidentiality and integrity but does not affect availability.

Mitigation Recommendations

As per the Red Hat advisory, no mitigation or fix currently meets the criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since exploitation requires valid client credentials and specific configurations, limiting credential exposure and reviewing configurations may reduce risk until a fix is available.

Threat ID: 6ab67f26f7a7c54106db3e8a

Added to database: 09/25/2026, 14:03:18 UTC

Last enriched: 09/25/2026, 14:18:12 UTC

Last updated: 09/26/2026, 01:57:26 UTC

Crowdsource mitigation strategies, intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Lead Pen Test Professional