Listen to this Post
The vulnerability exists within the keycloak-services component’s Token Exchange implementation. A privileged client, such as one with the `token-exchange` permission, can invoke the token exchange flow to obtain new access and refresh tokens. The flaw is a business logic error where the token service fails to re-validate the target user’s account status during the exchange process. When the privileged client presents a valid token and requests a token exchange for a specific user identifier, the system incorrectly assumes the user is still enabled. It proceeds to issue fresh tokens without checking the current `UserModel.isEnabled()` flag. This allows a user who has been administratively disabled, and whose previous tokens should be considered revoked, to regain active session credentials. The new tokens are generated with the same scope and privileges as the original, effectively bypassing the administrative disable action. The attack requires a compromised or malicious privileged client that is authorized to use the token exchange endpoint (/auth/realms/{realm}/protocol/openid-connect/token). The exploitation is stealthy as it does not generate typical authentication failure logs. The core issue is the missing validation step in the `TokenExchangeService.createExchangeToken` method chain, which should verify user status but only checks it during the initial authentication, not during the subsequent exchange operation.
Platform: Keycloak
Version: Not specified
Vulnerability: Disabled user token issuance
Severity: Moderate
date: Jan 21, 2026
Prediction: Patch date unknown
What Undercode Say:
curl -X POST \ -H "Authorization: Bearer <privileged_client_token>" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&requested_subject=<disabled_user_id>" \ http://localhost:8080/auth/realms/master/protocol/openid-connect/token
How Exploit:
Privileged client requests token exchange for disabled user identifier, receiving valid access/refresh tokens and bypassing account disable.
Protection from this CVE
Apply vendor patch. Restrict `token-exchange` permission. Monitor token exchange audit logs for disabled user IDs.
Impact:
Unauthorized privilege reinstatement. Bypass of account revocation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
