Keycloak's mTLS holder-of-key binding feature ensures tokens are bound to the client's digital certificate, preventing token misuse. However, the Standard Token Exchange V2 feature does not verify this certificate, enabling attackers with stolen client credentials to bypass mTLS constraints and obtain unconstrained Bearer tokens. The root cause is a missing enforcement check for client certificates in the Standard Token Exchange V2 grant provider. Red Hat rates this vulnerability as moderate severity due to the prerequisite conditions for exploitation and the impact of bypassing sender constraints.

Successful exploitation allows an attacker who already has valid client credentials and a valid subject token to bypass mTLS sender-constraints and obtain unrestricted Bearer tokens. This can lead to unauthorized access to protected resources and elevated privileges within the affected system. The vulnerability impacts confidentiality and integrity but does not affect availability.

As per the Red Hat advisory, no mitigation or fix currently meets the criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since exploitation requires valid client credentials and specific configurations, limiting credential exposure and reviewing configurations may reduce risk until a fix is available.