REDHAT-BUG-2540949: Medium severity Keycloak Keycloak vulnerability
A vulnerability was found in Keycloak where the Standard Token Exchange V2 grant path fails to enforce mTLS holder-of-key token binding. When a confidential client is configured with tls.client.certificate.bound.access.tokens set to true, Keycloak correctly rejects standard token grants if no client certificate is provided. However, an attacker who possesses the client credentials and a valid subject token can use the Standard Token Exchange V2 endpoint to obtain an active Bearer access token without presenting a TLS client certificate. The resulting token lacks the cnf.x5t#S256 claim, effectively bypassing the configured sender-constraint and allowing unauthorized access to protected resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set tls.client.certificate.bound.access.tokens to true so standard token grants without a client certificate are rejected and access tokens are bound to the client certificate.
Keycloak confidential clients tls.client.certificate.bound.access.tokens = true
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the confidential client's credentials and a valid subject token. They can then use the Standard Token Exchange V2 endpoint without presenting the TLS client certificate that the client configuration is intended to require.
Which deployments are affected?
Deployments using a confidential client with tls.client.certificate.bound.access.tokens set to true are affected when the Standard Token Exchange V2 grant path is available. The issue concerns token exchange rather than standard token grants, which correctly reject requests lacking a client certificate.
How can I tell whether exploitation may have occurred?
Look for Standard Token Exchange V2 requests made using the affected confidential client's credentials where no TLS client certificate was presented. A successful exploit produces an active Bearer access token that lacks the cnf.x5t#S256 claim.