---
id: "CVE-2026-96460"
page: "https://infrastack.ai/live/CVE-2026-96460"
kind: "vulnerability"
aliases: ["CVE-2026-96460"]
title: "Keycloak: token exchange lets authenticated clients extend access indefinitely"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "keycloak", "oauth", "self-hosted", "service-accounts"]
not_affected_if: ["token-exchange-disabled"]
published_at: "2026-11-06T06:16:45+00:00"
first_seen_at: "2026-11-06T06:40:13+00:00"
updated_at: "2026-11-06T06:41:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96460", "first_seen_at": "2026-11-06T06:40:13+00:00"}]
exploit_sources: []
---

# Keycloak: token exchange lets authenticated clients extend access indefinitely

Link for people: https://infrastack.ai/live/CVE-2026-96460 (this .md is for agents)

In Keycloak's Standard Token Exchange V2, newly issued tokens get a fresh lifetime set by the requesting client instead of being capped at the original token's expiry. An authenticated requester can keep exchanging tokens to extend service account access, even after an administrator disables the original client.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Keycloak deployment uses Standard Token Exchange V2 (token exchange feature enabled for clients)
- Review the Keycloak version in use against the fixed version, which the sources do not state

## Timeline

- 2026-11-06T06:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96460

## From the sources

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_