CVE-2025-14559 Keycloak services allows the issuance of access and refresh tokens for disabled users
Attackers can obtain valid tokens for disabled users via token exchange, bypassing account deactivation controls in Keycloak.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14559?
CVE-2025-14559 is a medium-severity vulnerability in Red Hat build of Keycloak 26.4, published on 21 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.
Weakness: CWE-840
Which versions are affected by CVE-2025-14559?
4 open source packages ship an affected version, including org.keycloak:keycloak-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions | 26.4.9 |
org.keycloak:keycloak-services Maven | All versions | 26.4.9 |
org.keycloak:keycloak-services Maven | From 26.5.0 | 26.5.2 |
org.keycloak:keycloak-services Maven | From 26.5.0 | 26.5.2 |
How do I fix CVE-2025-14559?
Upgrade org.keycloak:keycloak-services to a fixed version for your release line: 26.4.9 or 26.5.2.
Is CVE-2025-14559 being exploited?
There is no known exploitation of CVE-2025-14559 in the wild and no public exploit code.
Sources
Also known as ECHO-4c35-fcd8-ca55, GHSA-wv3h-x6c4-r867, MINI-cwrx-rrxw-5cfm, MINI-vx6g-mj3x-g988, UBUNTU-CVE-2025-14559.