CVE-2026-97846

Executive Summary

CVE-2026-97846 is an improper authentication flaw (CWE-287) in Keycloak affecting the Standard Token Exchange V2 feature, which fails to enforce the mTLS holder-of-key certificate binding that normally restricts a token to the client that originally requested it. An attacker who has stolen client credentials can therefore obtain a standard, unrestricted access token that bypasses the holder-of-key protection. With a CVSS 3.1 base score of 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), the vulnerability is network-reachable, requires a high degree of attack complexity and low privileges, and results in high confidentiality and integrity impact — making it a significant token-theft and privilege-escalation concern for any deployment using client certificate binding alongside token exchange.

Technical Analysis

Keycloak's mTLS holder-of-key (HoK) binding is a security control that cryptographically ties an issued token to the client's digital certificate, guaranteeing that a token can only be presented for use by the client that originally requested it. This binds token possession to possession of the corresponding private key, neutralizing the value of a stolen bearer token on its own.

The vulnerability resides in the Standard Token Exchange V2 feature. According to the NVD description, the Token Exchange V2 implementation "does not check for this certificate" when processing token exchange requests. The result is a divergence between two security expectations in the same product:

1. Tokens issued under holder-of-key binding are supposed to be non-transferable without the matching client certificate.
2. The token exchange path — which mints a new token from an existing one — issues a standard, unrestricted token without validating the certificate binding of the requesting client.

Because the certificate check is skipped, the holder-of-key guarantee is not propagated into the exchanged token. An attacker holding stolen client credentials can drive the token exchange flow and receive a standard token that no longer requires the original client's certificate, effectively stripping the mTLS binding from the credential chain.

The flaw class is improper authentication (CWE-287): a security-relevant authentication/binding decision is omitted on one code path (token exchange) even though it is enforced on others. The CVSS vector confirms the key characteristics: AC:H (high complexity — the attacker must already hold valid stolen client credentials and be positioned to invoke the token exchange), PR:L (low privileges required), and C:H/I:H with no availability impact — consistent with token impersonation rather than denial of service.

No specific function names, class names, endpoints, or code-level symbols are provided in the source data; the analysis above is limited to the mechanism described by the NVD entry. Additional implementation detail is not available from the provided intelligence.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the vulnerability class and the mechanism described in the NVD entry. It relies only on the two named features — mTLS holder-of-key binding and Standard Token Exchange V2 — and does not assume any unstated endpoint or parameter names.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment that uses mTLS holder-of-key binding for clients and has the Standard Token Exchange V2 functionality enabled. Such deployments are typically enterprise SSO environments where clients are configured for certificate-bound tokens and downstream services rely on token exchange for delegation or impersonation workflows.

2. Credential acquisition. The attacker obtains stolen client credentials (for example, a client secret or equivalent confidential-client material). The NVD description frames the precondition explicitly as "an attacker with stolen client credentials." This is the AC:H component: the flaw is not remotely exploitable without prior credential compromise, and the attacker must be capable of exercising the token exchange flow as that client.

3. Triggering the flaw. Using the stolen client credentials, the attacker invokes the Standard Token Exchange V2 flow. Normally, a holder-of-key-protected client would be required to prove possession of its certificate private key. Because Token Exchange V2 does not perform that certificate check, the binding validation is skipped and the exchange succeeds based on the stolen credentials alone.

4. Obtaining an unrestricted token. The result of the exchange is a standard, unrestricted token — one that is no longer bound to the original client's certificate. The holder-of-key restriction that would have prevented another party from using the token has effectively been removed.

5. Post-exploitation impact. The attacker can present the exchanged, unrestricted token to downstream resource servers and services that trust Keycloak-issued tokens. Because the token is standard and unbound, it can be used without possession of the victim client's private key. This yields unauthorized access as the impersonated client, with high confidentiality and integrity impact — reading protected resources (C:H) and performing actions as the client (I:H). There is no availability component (A:N).

Attack prerequisites are substantial: the attacker must already possess valid client credentials and be able to reach the token exchange functionality. The vulnerability's value to an adversary is that it converts stolen credentials into a durable, certificate-free token that defeats the holder-of-key control designed to contain exactly that kind of credential theft.

Impact Assessment

The vulnerability allows bypass of mTLS holder-of-key binding through the token exchange path, meaning the core security promise of client certificate binding — that a token cannot be used by anyone other than the client that requested it — is broken for exchanged tokens. Stolen client credentials, which under normal circumstances would still require the matching private key to exploit, instead yield a fully usable, unrestricted token.

CVSS subscores (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) map to the following impact profile:

• Attack Vector: Network — the token exchange interface is reachable over the network, so exploitation does not require local or adjacent access.
• Attack Complexity: High — exploitation depends on successful prior theft of client credentials, which is a non-trivial precondition.
• Privileges Required: Low — the attacker needs a valid client credential, but no administrative role.
• User Interaction: None — no victim user needs to take any action.
• Scope: Unchanged — the impact remains within the security authority of the vulnerable Keycloak component.
• Confidentiality: High / Integrity: High — the attacker gains access to resources and can perform actions as the impersonated client.
• Availability: None — the flaw does not degrade service availability.

Blast radius is potentially large in enterprises that centrally use Keycloak for authentication across many downstream services. Any service that trusts Keycloak-issued tokens could accept the attacker's exchanged token, extending the impact beyond a single application to the broader federated identity fabric. Because token exchange is often used for delegation and service-to-service scenarios, the compromised token may grant access in multiple trust domains simultaneously.

There is no evidence of CISA KEV listing and no known exploit-in-the-wild at time of writing; EPSS has not been scored by FIRST.org and no value should be inferred.

Detection Guidance

Detection should focus on anomalous token exchange activity and on correlations between clients configured for holder-of-key binding and subsequently issued standard tokens.

Sigma Rule

title: Keycloak Token Exchange V2 Bypassing mTLS Holder-of-Key Binding
id: 8f2a1c74-3b9d-4e6a-9c11-7d5e0a2b6f31
status: experimental
description: Detects Keycloak Standard Token Exchange V2 activity where a client configured for mTLS holder-of-key binding obtains an unrestricted token, potentially indicating CVE-2026-97846 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97846
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1550
logsource:
  product: keycloak
  service: auth
detection:
  selection_event:
    event.action: 'TOKEN_EXCHANGE'
  selection_client:
    client.authentication.method: 'mtls'
  selection_grant:
    grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange'
  condition: selection_event and selection_grant and selection_client
falsepositives:
  - Legitimate token exchange by properly certificate-bound clients
level: medium

YARA Rule

rule CVE_2026_97846_Keycloak_Token_Exchange_HoK_Bypass
{
    meta:
        description = "Detects Keycloak Standard Token Exchange V2 requests associated with holder-of-key binding bypass (CVE-2026-97846)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97846"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $grant = "urn:ietf:params:oauth:grant-type:token-exchange" ascii nocase
        $exchange = "token-exchange" ascii nocase
        $hok = "holder-of-key" ascii nocase
        $mtls = "mtls" ascii nocase

    condition:
        ($grant or $exchange) and ($hok or $mtls)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97846 Keycloak Standard Token Exchange V2 Holder-of-Key Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"token"; http.header_names; content:"Authorization"; http.request_body; content:"grant_type=urn:ietf:params:oauth:grant-type:token-exchange"; nocase; reference:cve,2026-97846; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97846; classtype:attempted-user; sid:202697846; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ authentication where event.action == "TOKEN_EXCHANGE" and grant_type == "urn:ietf:params:oauth:grant-type:token-exchange" ]
  [ authentication where event.action in ("TOKEN_ISSUED", "TOKEN_REFRESH") and client.authentication.method == "mtls" ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:auth
| search event_type="TOKEN_EXCHANGE" OR grant_type="urn:ietf:params:oauth:grant-type:token-exchange"
| stats count min(_time) as first_seen max(_time) as last_seen values(client_id) as clients values(grant_type) as grants by src_ip user
| where count > 0
| eval severity=if(match(clients,"mtls") OR match(grants,"token-exchange"),"HIGH","MEDIUM")
| table first_seen last_seen src_ip user clients grants count severity

Wazuh OSSEC Rule

<group name="keycloak,">
  <rule id="100846" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">TOKEN_EXCHANGE</field>
    <field name="grant_type">urn:ietf:params:oauth:grant-type:token-exchange</field>
    <description>CVE-2026-97846: Keycloak token exchange request potentially bypassing mTLS holder-of-key binding</description>
    <mitre>
      <id>T1550</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented in the provided intelligence, and no affected version range is published.

1) Immediate mitigations. Given the absence of a vendor patch, organizations should reduce exposure by disabling the Standard Token Exchange V2 feature where it is not strictly required and cannot be safely controlled. Because the flaw is only exploitable by an attacker who already holds stolen client credentials, tightening client credential storage, rotation, and distribution is a high-value compensating control: rotate confidential client secrets, enforce short secret lifetimes, and monitor for anomalous client credential usage. Restrict network access to Keycloak token endpoints to only trusted sources, and review clients configured with mTLS holder-of-key binding to determine whether any depend on token exchange for delegated token issuance.

2) Patch/upgrade steps. No patch exists. Monitor Keycloak release notes, the vendor security advisories, and the NVD entry for CVE-2026-97846. When a fix is published, upgrade immediately and re-test any token exchange workflows that rely on holder-of-key binding to confirm the certificate check is enforced on the exchange path. Until a patch is available, treat all token exchange output as potentially unbound and apply downstream controls accordingly.

3) Long-term hardening. Enforce the principle that any code path that mints tokens must propagate the same binding constraints (holder-of-key) as the originating credential. Add automated tests that assert exchanged tokens remain certificate-bound when the source client is bound. Adopt centralized detection for token exchange events correlated with mTLS-configured clients. Reduce reliance on bearer tokens alone — validate sender-constrained tokens at resource servers where supported — and keep client credential rotation continuous so that stolen credentials have a limited useful lifetime. Track CISA KEV status and FIRST.org EPSS scoring as they become available.

References

• NVD — CVE-2026-97846: https://nvd.nist.gov/vuln/detail/CVE-2026-97846
• Keycloak project security documentation and release notes (mTLS holder-of-key binding and Standard Token Exchange): https://www.keycloak.org/documentation
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1550 — Use Alternate Authentication Material: https://attack.mitre.org/techniques/T1550/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-97846 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-97846 at time of writing. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted.