CVE-2025-14559: Keycloak services allows the issuance of access and refresh tokens for disabled users

January 21, 2026

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

References

access.redhat.com/security/cve/CVE-2025-14559
bugzilla.redhat.com/show_bug.cgi?id=2421711
github.com/advisories/GHSA-wv3h-x6c4-r867
github.com/keycloak/keycloak
github.com/keycloak/keycloak/issues/45651
nvd.nist.gov/vuln/detail/CVE-2025-14559

Code Behaviors & Features

Detect and mitigate CVE-2025-14559 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →