| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | ≥ 26.5.0, < 26.5.2< 26.4.9 | 26.5.226.4.9 |
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free