CVE-2022-1245

CVE-2022-1245 is a critical privilege escalation vulnerability in Red Hat Keycloak's token exchange feature. It allows an attacker with a valid access token to exchange it for tokens targeting any client, bypassing authorization and potentially gaining unauthorized access to additional services. With a CVSS score of 9.8, this flaw is easily exploitable over the network with low attack complexity, leading to high impact on confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the high severity warrants immediate attention.