Description

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-25T07:16:57.147Z",
  "pubdate": "2026-09-25T07:16:57.147Z",
  "executiveSummary": "A security vulnerability exists in Keycloak concerning the implementation of mTLS holder-of-key binding within the Standard Token Exchange V2 feature.\nThe vulnerability occurs because the token exchange process fails to validate or enforce the required client certificate binding during the issuance of standard tokens.\nThis flaw allows an attacker who has successfully compromised client credentials to circumvent the holder-of-key security protections.\nBy bypassing the mandatory mTLS certificate validation, an attacker can obtain a standard, unrestricted token that is not bound to the original client's certificate.\nThis increases the risk of unauthorized access, as the resulting token can be utilized by unauthorized parties or processes without the associated proof-of-possession required by the mTLS configuration.\nThe attack requires the adversary to possess valid client credentials to initiate the exchange process, after which the system erroneously grants a token that lacks the intended cryptographically enforced identity binding.\nThis vulnerability effectively invalidates the security posture provided by mTLS holder-of-key authentication in scenarios where Token Exchange V2 is enabled.",
  "technicalDetails": "The root cause of this vulnerability is an authentication logic failure in the Keycloak Standard Token Exchange V2 component where the implementation fails to propagate or verify the mTLS holder-of-key constraints during the token transformation process.\nKeycloak's mTLS holder-of-key binding is a security mechanism intended to ensure that an issued access token is cryptographically tied to the client's X.509 certificate. When a client requests a token, the server verifies the certificate and binds the token to that identity.\nHowever, when using the Standard Token Exchange V2 feature, the backend service responsible for issuing the exchanged token fails to check if the original security context required an mTLS binding. Consequently, the component issues a standard token that does not retain this association.\nThe attack flow proceeds as follows: First, an attacker obtains valid client credentials through secondary means such as credential harvesting or unauthorized access to configuration files. Second, the attacker initiates a request to the Standard Token Exchange V2 endpoint using the compromised credentials. Third, the Keycloak server processes the token exchange request; however, due to the identified defect, it neglects to perform the certificate validation check associated with the holder-of-key requirements. Finally, the server issues a standard, unrestricted token that is devoid of the mTLS binding restrictions, allowing the attacker to use this token against any downstream service that consumes the token without verifying the mTLS context.\nThe lack of enforcement means that once the exchange is complete, the resulting token is treated as an ordinary bearer token, effectively downgrading the security of the session from a cryptographically bound holder-of-key token to a standard, less secure token. This bypasses the primary intent of the mTLS configuration, which is to prevent token replay or unauthorized usage if a token were intercepted or misused by a party lacking the private key corresponding to the original client's certificate.\nThis vulnerability is localized to the token exchange functionality and affects all versions of Keycloak that include the Standard Token Exchange V2 implementation."
}