CVE-2022-1245: Privilege Escalation in Keycloak Token Exchange Feature
Summary
CVE-2022-1245: Keycloak vulnerable to privilege escalation on Token Exchange feature. Affects org.keycloak:keycloak-services versions < 18.0.0. Fixed in 18.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. It allows clients to obtain and exchange tokens for accessing various services. The token exchange feature enables clients to exchange tokens for other clients. However, a vulnerability has been discovered in this feature that allows a client with a valid access token to perform privilege escalation by exchanging tokens for any target client without proper authorization. This can lead to unauthorized access to additional services.
Vulnerability Detail
The privilege escalation vulnerability in Keycloak's token exchange feature arises from missing authorization checks. A client application holding a valid access token can exploit this flaw by passing the client_id of the target client during token exchange. This allows the client to gain unauthorized access to services intended for the target client. The impact of this vulnerability is critical, as it enables an attacker to bypass access controls and potentially compromise sensitive data or perform unauthorized actions.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
18.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Keycloak to the fixed version.
Conclusion
The privilege escalation vulnerability in Keycloak's token exchange feature can lead to unauthorized access to additional services. It is crucial to upgrade Keycloak to the fixed version (18.0.0 or later) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The token exchange feature in Keycloak allows clients to exchange tokens for accessing various services. It enables clients to obtain tokens for other clients.
Privilege escalation refers to the act of gaining higher privileges or access rights than originally intended or authorized. In the context of this vulnerability, it means a client can gain unauthorized access to services intended for another client.
The impact of this vulnerability is critical. It allows an attacker to bypass access controls and gain unauthorized access to additional services, potentially compromising sensitive data or performing unauthorized actions.
To fix this vulnerability, you need to upgrade Keycloak to version 18.0.0 or later. Update the Keycloak dependency in your project's Maven configuration (pom.xml) to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
