Keycloak mTLS Holder-of-Key Bypass via Token Exchange

Executive Summary

This vulnerability affects Keycloak's mTLS holder-of-key binding feature, which normally ties tokens to a client's digital certificate for security. The flaw is in the Standard Token Exchange V2 feature, which fails to verify this certificate binding. Attackers with stolen client credentials can exploit this to obtain unrestricted tokens that bypass security protections.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for unusual token exchange activities, particularly requests to the Standard Token Exchange V2 endpoint without client certificate validation. Check for tokens issued without the expected cnf.x5t#S256 claim in environments where mTLS holder-of-key binding is enforced.

Useful 0 Not Useful 0

Impact Analysis

An attacker could bypass mTLS sender-constraints and obtain unconstrained Bearer tokens, gaining unauthorized access to protected resources. Exploitation requires valid client credentials and a subject token, and works only under specific non-default configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Standard Token Exchange V2 feature if not required. Ensure all token exchanges enforce mTLS client certificate binding by verifying the cnf.x5t#S256 claim. Review and revoke any tokens issued without proper binding to prevent unauthorized access.

Useful 0 Not Useful 0