PT-2026-3753 · Red Hat · Keycloak

Published 2026-01-21 · Updated 2026-02-10 · CVE-2025-14559

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the keycloak-services component of Keycloak. This issue allows the issuance of access and refresh tokens for disabled users, potentially leading to unauthorized use of previously revoked privileges. The root cause is a business logic vulnerability within the Token Exchange implementation when a privileged client initiates the token exchange flow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-840

CWE-863

Related Identifiers

BDU:2026-01119

CVE-2025-14559

GHSA-WV3H-X6C4-R867

Affected Products

Keycloak

References · 20

• https://access.redhat.com/errata/RHSA-2026:2366 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14559 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14559 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14559 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wv3h-x6c4-r867 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:2365 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01119 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/2d0aa31c4830ebaad094c3762e78b884c141e659 · Note
• https://github.com/keycloak/keycloak/releases/tag/26.5.2 · Note
• https://github.com/keycloak/keycloak/commit/d67349f3aa9fed5c61750619d0f9de6356aeaeff · Note
• https://github.com/keycloak/keycloak/issues/45651 · Note
• https://twitter.com/VulmonFeeds/status/2013892624738885780 · Twitter Post
• https://twitter.com/CVEnew/status/2013870047434023009 · Twitter Post