CVE-2025-14559 - CVE House

Back to Database

Status published Medium CVE-2025-14559

Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

6.5 CVSS

Vulnerability Description

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14559

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Aytac Kalinci for reporting this issue.

References

More from Red Hat

View All →

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Libsoup: improper handling of http vary header in libsoup caching

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.9

Vulnerable Versions:

26.4.9-1, 26.4-11, 26.4-10

Timeline

Official Publish: January 21st, 2026

Last Modified: February 10th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.