Critical Vulnerability in Keycloak CVE-2026-97846 Exposes Token Security

• •CVE-2026-97846 allows token bypass in Keycloak's Standard Token Exchange V2 feature.
• •Exploitation requires valid client credentials and specific configurations.
• •No effective mitigation is currently available; users should monitor for updates.

A vulnerability identified as CVE-2026-97846 in Keycloak's Standard Token Exchange V2 feature allows attackers with stolen client credentials to bypass mTLS holder-of-key binding protections. This flaw enables the acquisition of unrestricted Bearer tokens, potentially leading to unauthorized access to sensitive resources. The vulnerability is rated as moderate due to the requirement for valid client credentials and specific configurations for exploitation. Currently, no effective mitigation or fix is available, and organizations are advised to monitor Red Hat advisories for updates. The vulnerability impacts confidentiality and integrity but does not affect system availability. Exploitation complexity is high, requiring significant effort and specific conditions. Keycloak users are urged to limit credential exposure and review configurations to reduce risk until a patch is released.