{"id":"CVE-2026-96460","kind":"vulnerability","aliases":["CVE-2026-96460"],"related":[],"title":"Keycloak: token exchange lets authenticated clients extend access indefinitely","description":"A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.","summary":"In Keycloak's Standard Token Exchange V2, newly issued tokens get a fresh lifetime set by the requesting client instead of being capped at the original token's expiry. An authenticated requester can keep exchanging tokens to extend service account access, even after an administrator disables the original client.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","keycloak","oauth","self-hosted","service-accounts"],"not_affected_if":["token-exchange-disabled"],"how_to_check":"- Check whether the Keycloak deployment uses Standard Token Exchange V2 (token exchange feature enabled for clients)\n- Review the Keycloak version in use against the fixed version, which the sources do not state","fix":null,"status":"open","published_at":"2026-11-06T06:16:45+00:00","first_seen_at":"2026-11-06T06:40:13+00:00","triaged_at":"2026-11-06T06:41:38+00:00","updated_at":"2026-11-06T06:41:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T06:41:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: token exchange lets authenticated clients extend access indefinitely","impact":"medium","summary":"In Keycloak's Standard Token Exchange V2, newly issued tokens get a fresh lifetime set by the requesting client instead of being capped at the original token's expiry. An authenticated requester can keep exchanging tokens to extend service account access, even after an administrator disables the original client.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","service-accounts","oauth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"disabled service accounts keep access via repeated token exchange","analyst_note":"Find the affected and fixed Keycloak versions and confirm which configuration enables Standard Token Exchange V2, using the NVD entry linked in the sources.","how_to_check":"- Check whether the Keycloak deployment uses Standard Token Exchange V2 (token exchange feature enabled for clients)\n- Review the Keycloak version in use against the fixed version, which the sources do not state\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["token-exchange-disabled"],"who_is_affected":"Organizations running Keycloak as an identity provider with token exchange enabled, where service accounts or clients can request exchanged tokens. The sources do not name the affected version range or the exact configuration required. Deployments that do not use token exchange are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4247,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96460':12A,15A 'access':8A,65B,124C 'account':24B,64B,127C 'administr':69B,142C 'allow':117C 'authent':5A,55B,119C 'base':100C 'cap':47B 'client':6A,43B,73B,104C,136C 'configur':105C 'cve':10A,13A 'disabl':70B,139C 'even':66B,132C 'exchang':3A,30B,59B,81C,89C,130C 'expir':114C 'expiri':53B 'extend':7A,62B,123C 'flaw':75C 'found':77C 'fresh':37B,98C 'get':35B 'host':21B 'indefinit':9A,122C 'infrastructur':16B 'instead':44B,106C 'issu':33B,93C,116C 'keep':58B 'keycloak':1A,17B,26B,84C 'let':4A 'lifetim':38B,99C 'limit':108C 'mechan':82C 'new':94C 'newli':32B 'oauth':18B 'origin':50B,72B,112C,135C 'repeat':129C 'request':42B,56B,103C,120C 'self':20B 'self-host':19B 'servic':23B,63B,126C 'service-account':22B 'set':39B 'standard':28B,87C 'system':92C 'token':2A,29B,34B,51B,60B,80C,88C,95C,113C,131C 'use':86C 'v2':31B,90C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Keycloak as an identity provider with token exchange enabled, where service accounts or clients can request exchanged tokens. The sources do not name the affected version range or the exact configuration required. Deployments that do not use token exchange are likely not exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","keycloak","medium","oauth","selfhosted","serviceaccounts"],"campaign_type":null,"search_a":"'-2026':11A,14A '-96460':12A,15A 'access':8A 'authent':5A 'client':6A 'cve':10A,13A 'exchang':3A 'extend':7A 'indefinit':9A 'keycloak':1A 'let':4A 'token':2A","search_b":"'access':65B 'account':24B,64B 'administr':69B 'authent':55B 'cap':47B 'client':43B,73B 'disabl':70B 'even':66B 'exchang':30B,59B 'expiri':53B 'extend':62B 'fresh':37B 'get':35B 'host':21B 'infrastructur':16B 'instead':44B 'issu':33B 'keep':58B 'keycloak':17B,26B 'lifetim':38B 'newli':32B 'oauth':18B 'origin':50B,72B 'request':42B,56B 'self':20B 'self-host':19B 'servic':23B,63B 'service-account':22B 'set':39B 'standard':28B 'token':29B,34B,51B,60B 'v2':31B","search_c":"'access':124C 'account':127C 'administr':142C 'allow':117C 'authent':119C 'base':100C 'client':104C,136C 'configur':105C 'disabl':139C 'even':132C 'exchang':81C,89C,130C 'expir':114C 'extend':123C 'flaw':75C 'found':77C 'fresh':98C 'indefinit':122C 'instead':106C 'issu':93C,116C 'keycloak':84C 'lifetim':99C 'limit':108C 'mechan':82C 'new':94C 'origin':112C,135C 'repeat':129C 'request':103C,120C 'servic':126C 'standard':87C 'system':92C 'token':80C,88C,95C,113C,131C 'use':86C 'v2':90C","first_public_at":"2026-11-06T06:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96460","severity":null,"published_at":"2026-11-06T06:16:45+00:00","modified_at":"2026-11-06T06:16:45+00:00","first_seen_at":"2026-11-06T06:40:13+00:00","fetched_at":"2026-11-06T06:40:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}