CVE-2025-14559: 
Java vulnerability analysis and mitigation

CVE-2025-14559 is a business logic vulnerability in the keycloak-services component of Keycloak that allows a privileged client to issue valid access and refresh tokens for disabled user accounts via the Token Exchange flow. The flaw was reported on December 12, 2025, and publicly disclosed on January 21, 2026. Affected versions include org.keycloak:keycloak-services < 26.4.9 and >= 26.5.0, < 26.5.2. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Red Hat (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-840 (Business Logic Errors) by Red Hat and CWE-863 (Incorrect Authorization) by GitHub Advisory. During the Token Exchange flow, Keycloak correctly validates the requesting privileged client but omits a check on whether the requested_subject user account is enabled. This allows an internal client with impersonation permissions to obtain tokens for explicitly disabled accounts — effectively resurrecting "zombie accounts" for former employees or banned users — without any interaction from the disabled user and without the disabled user directly authenticating (Red Hat Bugzilla, GitHub Advisory). The fix is tracked in the Keycloak repository at commits d67349f and 2d0aa31 (GitHub Advisory).

Successful exploitation allows an attacker controlling a high-privileged internal Keycloak client to obtain fully valid access and refresh tokens for any disabled user account, effectively bypassing account deactivation controls. This results in high confidentiality and integrity impact — the attacker can access resources and perform actions as the disabled user, potentially including former administrators or privileged accounts. Availability is not directly impacted, but the ability to impersonate revoked identities poses significant risk for privilege escalation and unauthorized data access across any system relying on Keycloak for authentication (Red Hat CVE, GitHub Advisory).

1. Identify a privileged client: Obtain credentials or access for an internal Keycloak client that has the impersonation permission granted within the target realm.
2. Identify a disabled target user: Enumerate user accounts in the Keycloak realm (via Admin API or prior knowledge) to identify a disabled account with elevated privileges (e.g., a former administrator).
3. Invoke the Token Exchange flow: Send a Token Exchange request to the Keycloak token endpoint, specifying the disabled user's ID or username as the requested_subject parameter:

   POST /realms/{realm}/protocol/openid-connect/token
   grant_type=urn:ietf:params:oauth:grant-type:token-exchange
   &client_id={privileged_client_id}
   &client_secret={client_secret}
   &requested_subject={disabled_user_id}
   &subject_token={current_access_token}

4. Receive tokens for disabled user: Due to the missing validation, Keycloak issues valid access and refresh tokens for the disabled account.
5. Use tokens to access resources: Present the obtained tokens to downstream services or APIs that trust Keycloak-issued tokens, gaining unauthorized access with the disabled user's privileges (Red Hat Bugzilla, GitHub Advisory).

• Logs: Keycloak audit/event logs showing Token Exchange grant type (urn:ietf:params:oauth:grant-type:token-exchange) requests where the requested_subject corresponds to a disabled user account; successful token issuance events for accounts with enabled=false status.
• Logs: Downstream service access logs showing activity from accounts that should be inactive, particularly outside normal business hours or from unexpected IP addresses.
• Network: Repeated Token Exchange requests from a single client ID targeting multiple user accounts, which may indicate enumeration of disabled accounts.
• Keycloak Admin: Unexpected active sessions or token activity associated with disabled user accounts visible in the Keycloak Admin Console under Sessions.

Upgrade org.keycloak:keycloak-services to version 26.4.9 or 26.5.2, which contain the fix for this vulnerability. Red Hat has released security advisories RHSA-2026:2365 (Red Hat build of Keycloak 26.4.9) and RHSA-2026:2366 addressing this issue (Red Hat RHSA-2026:2365, Red Hat RHSA-2026:2366). As a workaround, restrict or revoke impersonation permissions from internal clients that do not strictly require them, and audit all clients with Token Exchange capabilities. Organizations should also review Keycloak audit logs for any Token Exchange activity involving disabled accounts prior to patching.

The vulnerability was assigned by Red Hat and tracked internally since December 2025 before public disclosure in January 2026. It was included in the Red Hat build of Keycloak 26.4.9 security advisory alongside several other CVEs, rated "Important" in aggregate (Red Hat RHSA-2026:2365). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database aggregation.