CVE-2022-1245: 
Java vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2022-1245) was discovered in the token exchange feature of Keycloak. The vulnerability was disclosed on April 25, 2022, affecting Keycloak versions prior to 18.0.0. The flaw allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target, potentially leading to unauthorized access (Keycloak Advisory).

The vulnerability stems from missing authorization controls in Keycloak's token exchange feature. The flaw is classified under CWE-284 (Improper Access Control) and has been assessed with a Moderate severity rating. The issue specifically affects the token exchange mechanism where authorization checks were insufficient to prevent unauthorized token exchanges between clients (Keycloak Advisory, Red Hat Advisory).

The vulnerability could allow a malicious client application to perform privilege escalation by exchanging tokens for any target client, potentially gaining unauthorized access to additional services. This could lead to unauthorized access to protected resources and services within the Keycloak ecosystem (Keycloak Advisory).

The vulnerability has been patched in Keycloak version 18.0.0. Users are advised to upgrade to this version or later to address the security issue. Red Hat has also released security updates for affected products, including Red Hat Single Sign-On 7.5.2 for RHEL 8 (Red Hat Advisory).