A vulnerability was found in 3Scale when using with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the authtype is use3scaleoidcissuerendpoint, Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO 7.5. As the result, the policy doesn't inspect tokens; it determines that all tokens are valid.

Using an alternate authtype: authtype: clientid+clientsecret. Disabling the policy entirely might be a temporary solution if the alternate {{authtype is not feasible for some reason. The only purpose the token introspection endpoint serves is for sessions which are revoked in RH SSO before the standard TTL expires via the exp claim.