Is CVE-2026-97846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97846 being exploited in the wild.

How severe is CVE-2026-97846?

Medium severity, with a CVSS score of 6.8, published 25 September 2026.

Which products and versions are affected?

Red Hat build of Keycloak ; Red Hat Keycloak .

Is there a fix for CVE-2026-97846?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97846 attacked?

It is attacked over the network.

Am I affected by CVE-2026-97846?

Check whether you run Red Hat build of Keycloak or Red Hat Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97846: Keycloak mTLS holder-of-key binding bypass in Standard Token Exchange

CVE-2026-97846 · Severity: medium · CVSS 6.8 · Published 2026-09-25

Keycloak is an open-source identity and access management system that authenticates users and issues security tokens. A flaw in the Standard Token Exchange V2 feature fails to verify a client's certificate, allowing an attacker with stolen credentials to obtain tokens that bypass mTLS security restrictions. This could enable unauthorized access to applications and data that rely on certificate-based authentication.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-97846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97846 being exploited in the wild.
How severe is CVE-2026-97846?: Medium severity, with a CVSS score of 6.8, published 25 September 2026.
Which products and versions are affected?: Red Hat build of Keycloak <UNKNOWN>; Red Hat Keycloak <UNKNOWN>.
Is there a fix for CVE-2026-97846?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97846 attacked?: It is attacked over the network.
Am I affected by CVE-2026-97846?: Check whether you run Red Hat build of Keycloak or Red Hat Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Standard Token Exchange V2 grant provider in Keycloak does not enforce verification of client certificates when issuing tokens, violating the mTLS holder-of-key binding mechanism that should tie tokens to specific client certificates. Exploitation requires the attacker to possess valid client credentials and a valid subject token in a non-default configuration. Successful exploitation allows bypassing sender-constraints and obtaining unrestricted Bearer tokens that can be used outside the context of the original client's certificate.

Affected products

Red Hat Keycloak <UNKNOWN>
Red Hat build of Keycloak <UNKNOWN>

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.