CVE-2026-96460 · Infrastructure
NO FIX YET
In Keycloak's Standard Token Exchange V2, newly issued tokens get a fresh lifetime set by the requesting client instead of being capped at the original token's expiry. An authenticated requester can keep exchanging tokens to extend service account access, even after an administrator disables the original client.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Keycloak as an identity provider with token exchange enabled, where service accounts or clients can request exchanged tokens. The sources do not name the affected version range or the exact configuration required. Deployments that do not use token exchange are likely not exposed, but the sources do not confirm this.
Not affected if token-exchange-disabled
Who cares keycloak, oauth, self-hosted, service-accounts
No fix yet, per the sources.
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.