SecBoard
Zurück zur CVE-Übersicht

CVE-2026-97846

MEDIUM(6.8)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Risk Signal Score22/100 — NIEDRIG
  • CVSS 6.8 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

6.8

Technische Schwere

Beschreibung

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "Standard Token Exchange V2" and InitiatingProcessCommandLine contains "grant_type=urn:ietf:params:oauth:grant-type:token-exchange"
| where not (InitiatingProcessCommandLine contains "tls.client.certificate.bound.access.tokens=true") // This is a placeholder and needs refinement based on actual Keycloak logs and configuration.
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine

Splunk SPL

index=your_keycloak_index (sourcetype=your_keycloak_sourcetype OR source=your_keycloak_source) "Standard Token Exchange V2" "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" NOT "tls.client.certificate.bound.access.tokens=true" // This is a placeholder and needs refinement based on actual Keycloak logs and configuration.
| table _time, host, source, sourcetype, message

Sigma

title: Keycloak mTLS Bypass Attempt
status: experimental
description: Detects attempts to bypass mTLS holder-of-key binding in Keycloak via Standard Token Exchange V2.
logsource:
  product: keycloak
  service: audit
detection:
  selection:
    message|contains|all:
      - 'Standard Token Exchange V2'
      - 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange'
    message|contains|not:
      - 'tls.client.certificate.bound.access.tokens=true' # Placeholder, refine based on actual Keycloak logs
  condition: selection
level: medium

Elastic ES|QL

from logs-keycloak-*
| where message : "Standard Token Exchange V2" and message : "grant_type=urn:ietf:params:oauth:grant-type:token-exchange"
| where not message : "tls.client.certificate.bound.access.tokens=true" // This is a placeholder and needs refinement based on actual Keycloak logs and configuration.
| select @timestamp, host.name, message

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen