Keycloak SingleUseObjectProvider Authorization Code Forgery Vulnerability Allowing Privilege Escalation

A vulnerability exists in Keycloak's SingleUseObjectProvider, which serves as a global key-value store. This flaw arises from inadequate type and namespace isolation, enabling an unauthenticated attacker to forge authorization codes. Exploiting this vulnerability can result in the creation of access tokens with administrative privileges, leading to unauthorized privilege escalation.

Impact

Exploitation of this vulnerability allows for privilege escalation by forging authorization codes and obtaining admin-capable access tokens.