CVE-2022-1245: Red Hat Keycloak

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

Affected products

• Red Hat Keycloak: before 18.0.0 (fixed in 18.0.0)

Published 2022-07-08. Last modified 2026-06-17.