Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-14559

Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.9-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-11 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-10 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.9

Default version status: unaffected

References