{"id":"CVE-2026-97846","aliases":[],"cve":{"records":[{"id":"CVE-2026-97846","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T05:55:10.210Z","published":"2026-09-25T06:16:38.415Z","modified":"2026-11-06T10:27:50.161Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T10:27:50.161Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-25T13:53:07.688Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97846","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540949","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-287","description":"Improper Authentication","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-25T13:52:32.447170Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding","titleSource":"redhat","descriptionSource":"redhat","description":"Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.","score":6.8,"severity":"medium","published":"2026-09-25T06:16:38.415Z","modified":"2026-11-06T10:27:50.161Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"},{"vendor":"Red Hat","name":"Red Hat Single Sign-On 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"}],"references":["https://access.redhat.com/errata/RHSA-2026:95761","https://access.redhat.com/security/cve/CVE-2026-97846","https://bugzilla.redhat.com/show_bug.cgi?id=2540949"],"sources":[{"name":"CVE","id":"CVE-2026-97846","modified":"2026-11-06T10:27:50.161Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-06T10:51:59.809Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:25:33.720Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T13:05:35.828Z","attemptedAt":"2026-11-06T13:05:35.828Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T13:05:38.043Z","attemptedAt":"2026-11-06T13:05:38.043Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T13:05:38.314Z","attemptedAt":"2026-11-06T13:05:38.314Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T13:05:38.043Z","attemptedAt":"2026-11-06T13:05:38.043Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-97846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97846","modified":"2026-11-06T11:17:24.077","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T13:05:35.828Z"},{"source":"FIRST EPSS","id":"CVE-2026-97846","url":"https://www.first.org/epss/","probability":0.00135,"percentile":0.02983,"date":"2026-11-05","checkedAt":"2026-11-06T13:05:38.043Z"},{"source":"GitHub Advisory Database","id":"GHSA-f7cv-8449-mr73","url":"https://github.com/advisories/GHSA-f7cv-8449-mr73","modified":"2026-11-06T12:31:35Z","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T13:05:38.043Z"},{"source":"ENISA EUVD","id":"EUVD-2026-86530","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-86530","modified":"Nov 6, 2026, 10:27:50 AM","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T13:05:38.314Z"}],"aiSummary":{"text":"A flaw in Keycloak's Standard Token Exchange V2 feature bypasses the mTLS holder-of-key binding, allowing an attacker with stolen client credentials to obtain an unrestricted token. The affected versions are not specified. The weakness is related to improper authentication.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T10:56:02.762Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97846"}]}}