CVE-2025-14559
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.5.2 |
| Maven | org.keycloak:keycloak-services | 26.4.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.3-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-26.5 | 26.5.2-r0 |
| Chainguard | keycloak-26.5-iamguarded-compat | 26.5.2-r0 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.5 | 26.5.2-r0 |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | 26.5.2-r0 |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Ubuntu 24.04 LTS | python-keycloak | no fix |
| Ubuntu 25.10 | python-keycloak | no fix |
| Ubuntu 26.10 | python-keycloak | no fix |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |
| Wolfi | keycloak-26.5 | 26.5.2-r0 |
| Wolfi | keycloak-26.5-iamguarded-compat | 26.5.2-r0 |