Description

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-19T15:17:08.627Z",
  "pubdate": "2026-09-19T15:17:08.627Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw within the OIDC protocol implementation in Keycloak. The defect exists in the token refresh logic, specifically during the reconstruction of requested audiences from stored client identifiers.\nThe vulnerability allows an attacker possessing a valid, non-expired refresh token associated with a previously active client to continue generating new access tokens, even after the target client has been administratively disabled.\nThis bypasses security controls intended to revoke access to resource servers that rely on offline JWT validation (where the resource server does not perform an introspective check against the authorization server).\nThe risk is categorized as significant because it undermines administrative access control and lifecycle management policies. Successful exploitation requires an attacker to have obtained a valid refresh token prior to the client being disabled, but requires no additional authentication or privilege escalation during the refresh request itself.\nThe primary impact is unauthorized access to downstream services that trust the OIDC tokens issued by the Keycloak instance, effectively extending the lifespan of access credentials for disabled or compromised clients.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation performed by the Keycloak token endpoint during the refresh token grant process. Specifically, when Keycloak processes a refresh request, it restores the requested audiences by resolving the client IDs stored within the refresh token metadata.\nDuring this reconstruction phase, the server implementation fails to check the current operational status of the client identified as the intended audience. In a standard OIDC flow, the authorization server must verify that all components of the token—including the subject, the audience, and the associated client—remain in a valid, enabled state.\nThe attack flow proceeds as follows: First, an attacker captures or possesses a refresh token that was issued when the target client was active. Second, the administrator disables the target client within the Keycloak administrative console, intended to revoke access for that client. Third, the attacker initiates a standard OIDC refresh request using the previously obtained refresh token. Fourth, the Keycloak server parses the refresh token, reconstructs the context, and proceeds to issue a new access token without re-verifying the current 'enabled' status of the client defined in the audience field.\nBecause the resulting JWT contains a valid audience claim for the disabled client, resource servers that perform stateless, offline validation of the JWT (e.g., verifying the signature against the Keycloak public key and checking standard claims like 'exp', 'aud', and 'iss') will accept the token as legitimate. These resource servers lack the means to know that the client has been disabled on the authorization server side, leading to an effective bypass of administrative access restrictions.\nThis behavior persists as long as the refresh token remains valid according to the server's session expiration policy. The exploit does not require administrative privileges or further interaction with the identity provider, as the vulnerability resides within the inherent logic of the token issuance protocol implementation within Keycloak."
}