The vulnerability in Red Hat Build of Keycloak involves a missing authorization check during the token exchange process that swaps a Google token for a Keycloak token. Specifically, the hosted-domain claim validation is absent, allowing attackers with valid Google accounts from domains not permitted by the configured Google Workspace domain restrictions to bypass these restrictions and obtain unauthorized Keycloak tokens. This flaw requires the preview Token Exchange V1 feature to be enabled and specific client permissions granted. Red Hat has assessed the severity as moderate with a CVSS 3.1 score of 6.8. No official fix or mitigation that meets Red Hat's standards for ease of use, applicability, or stability is currently available.

Successful exploitation allows an attacker to bypass Google hosted-domain restrictions and gain unauthorized access to Keycloak realms by obtaining valid Keycloak tokens. This leads to high confidentiality and integrity impacts, enabling attackers to read and modify sensitive application data. There is no impact on availability. The attack requires network access, low privileges, and no user interaction, but has high attack complexity due to required feature enablement and permissions.

Currently, no official fix or mitigation meeting Red Hat's criteria for ease of use, applicability, or stability is available. Users should monitor the Red Hat advisory for updates. Mitigation options that do not meet Red Hat's standards may exist but are not recommended. Organizations should evaluate the risk of enabling the preview Token Exchange V1 feature and restrict its use accordingly until a fix is released.