CVE-2026-96460
MEDIUM(5.4)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS 5.4 — Mittel
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.2%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
5.4
Technische Schwere
Beschreibung
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Threat-Hunting-Queries
Sentinel/Defender KQL
IdentityTokenInfo
| where ClientId == "[RequesterClientId]"
| where TokenExchangeType == "Standard Token Exchange V2"
| summarize TokenExchanges = count(), FirstExchange = min(TimeGenerated), LastExchange = max(TimeGenerated) by SubjectTokenId
| where TokenExchanges > [ThresholdForRepeatedExchanges] and LastExchange - FirstExchange > [ThresholdForExtendedAccess]Splunk SPL
sourcetype=keycloak_logs "Standard Token Exchange V2" "client_id=[RequesterClientId]"
| stats count as TokenExchanges, min(_time) as FirstExchange, max(_time) as LastExchange by subject_token_id
| where TokenExchanges > [ThresholdForRepeatedExchanges] AND (LastExchange - FirstExchange) > [ThresholdForExtendedAccess]Sigma
title: Keycloak Indefinite Token Renewal
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential indefinite access token renewal in Keycloak via Standard Token Exchange V2.
author: SecBoard
date: 2026/09/23
logsource:
product: keycloak
service: logs
detection:
selection:
message|contains: "Standard Token Exchange V2"
client_id: "[RequesterClientId]"
timeframe: 1h
condition: selection | stats count() as token_exchanges by subject_token_id | where token_exchanges > [ThresholdForRepeatedExchanges]
falsepositives:
- Legitimate repeated token exchanges within expected limits
level: mediumElastic ES|QL
from keycloak_logs
| where message : "Standard Token Exchange V2" and client_id == "[RequesterClientId]"
| stats token_exchanges = count(), first_exchange = min(@timestamp), last_exchange = max(@timestamp) by subject_token_id
| where token_exchanges > [ThresholdForRepeatedExchanges] and (last_exchange - first_exchange) > [ThresholdForExtendedAccess]SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.