Keycloak Single-Use Object Provider Vulnerability Allowing Action Token Replay

A vulnerability exists in Keycloak's SingleUseObjectProvider, which is a global key-value store that lacks proper type and namespace isolation. This flaw allows an attacker to delete arbitrary single-use entries, potentially enabling the replay of consumed action tokens, such as password reset links. Such exploitation could lead to unauthorized access or account compromise.

Impact

Exploitation of this vulnerability could allow for the unauthorized replay of action tokens, such as password reset links, leading to potential account compromise.