Threats tagged 'ghsa-f7cv-8449-mr73'

Keycloak's mTLS holder-of-key binding feature ensures tokens are bound to the client's digital certificate. A vulnerability in the Standard Token Exchange V2 feature allows tokens to be obtained without checking this certificate binding. This flaw enables attackers with stolen client credentials to acquire unrestricted tokens that bypass intended security protections.