BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Red Hat

CVE-2026-96460: A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on

CVE-2026-96460 Nov 6, 2026 Source: Vendor

A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This issue allows an authenticated requester to indefinitely extend access for service accounts by repeatedly exchanging tokens, even if the original client has been disabled by an administrator.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-96460
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
Showing 1–1 of 1 matching , clear filters
CVE-2026-96460 BR2026-0000-042866 unclaimed
Credited as Red Hat would like to thank Stian Thorgersen (IBM) for reporting this issue