Skip to content

Privilege escalation vulnerability on Token Exchange feature

Moderate
abstractj published GHSA-75p6-52g3-rqc8 Apr 25, 2022

Package

maven org.keycloak.services (Maven)

Affected versions

< 18.0.0

Patched versions

18.0.0

Description

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

Severity

Moderate

CVE ID

CVE-2022-1245

Weaknesses

Credits