Keycloak x < 26.4.9 / 26.5.x < 26.5.2 Token Exchange Vulnerability

Language:

Version 1.2 Feb 3, 2026, 2:33 PM CVSS metrics ("CVSSv2 score" set to 7.7) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202602031433
Version 1.1 Feb 2, 2026, 1:44 PM New Plugin Feed: 202602021344

* Changelogs are generally available for changes made after Nov 1, 2022