CVE-2025-14559: Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

A business logic vulnerability exists in the Token Exchange implementation within the keycloak-services component. When a privileged client invokes the token exchange flow, Keycloak correctly validates the client but fails to validate whether the target “requestedsubject” user is enabled. This omission allows issuance of access and refresh tokens for users whose accounts have been explicitly disabled. An internal client with the impersonation permission can therefore resurrect “zombie accounts,” obtaining tokens for former employees or banned users despite account deactivation. This flaw enables unauthorized use of previously revoked privileges and relies solely on the presence of an internal high-privileged client, requiring no user interaction or direct authentication by the disabled user.