CVE-2026-97846

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description Keycloak includes an mTLS holder-of-key binding feature designed to ensure tokens are only usable by the client that originally requested them by binding the token to a digital certificate. A flaw exists in the Standard Token Exchange V2 feature where the required certificate check is not performed. This allows an attacker possessing stolen client credentials to acquire a standard, unrestricted token, effectively bypassing the mTLS security protections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.