A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of
    access and refresh tokens for disabled users, leading to unauthorized use of previously revoked
    privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged
    client invokes the token exchange flow. (CVE-2025-14559)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of     access and refresh tokens for disabled users, leading to unauthorized use of previously revoked     privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged     client invokes the token exchange flow. (CVE-2025-14559)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Keycloak installed on the remote host is prior to 26.4.9 / 26.5.2 / 26.6.0. It is, therefore, affected by the following Token Exchange vulnerability:
  - A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access     and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business     logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.     (CVE-2025-14559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
465098	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.4.9	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465098	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.4.9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
437576	SCA: security update for org.keycloak:keycloak-services (GHSA-wv3h-x6c4-r867)	Tenable Cloud Security	SCA Checks	Local	medium
437576	SCA: security update for org.keycloak:keycloak-services (GHSA-wv3h-x6c4-r867)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
297684	Linux Distros Unpatched Vulnerability : CVE-2025-14559	Nessus	Misc.	Local	medium
297527	Keycloak x < 26.4.9 / 26.5.x < 26.5.2 Token Exchange Vulnerability	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-14559

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium