CVE-2026-97846 — Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digit…
Published: 2026-09-25 · CVSS: 6.8 · CVSS 3.1
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7