A vulnerability in the OpenID Connect (OIDC) protocol implementation of Red Hat Build of Keycloak allows an application holding an existing refresh token to obtain new access tokens for a client that has been administratively disabled. This occurs because during the token refresh process, Keycloak restores requested audiences from stored client IDs but does not verify whether the target audience client is still enabled. Consequently, resource servers that rely on offline JWT validation may be bypassed, allowing continued access despite client disablement. The root cause is a missing authorization check on the enabled status of audience clients during token refresh and exchange.

An attacker with an existing refresh token for a client can continue to obtain valid access tokens even after the client has been disabled by administrators. This bypasses administrative access controls and may allow unauthorized access to resource servers that use offline JWT validation. The impact is rated moderate with low confidentiality and integrity impacts and no availability impact. Exploitation requires a specific sequence where a client is disabled after a refresh token has already been issued.

According to the Red Hat advisory, no mitigation is currently available or meets Red Hat's criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates on fixes or mitigations. Until a fix is released, administrators should be aware of the risk that disabled clients may still be able to obtain tokens if refresh tokens were issued prior to disablement.