EUVD-2026-45225
GHSA-v7m3-vpqr-6m6p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
OAuth client credentials required (PR:L); specific race-condition timing between CIBA approval and account lockout raises complexity (AC:H); only token confidentiality disclosed (C:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
AnalysisAI
Brute-force lockout bypass in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows an attacker holding valid OAuth client credentials to redeem previously approved authentication requests and obtain access and refresh tokens for a user account that has since been locked. This is an incomplete fix for CVE-2026-9798: the brute-force protection check was applied to the CIBA initiation handler but was never added to the token redemption handler, creating a gap that persists after the earlier patch. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the keycloak-services component that implements the CIBA (Client-Initiated Backchannel Authentication) flow, an OAuth 2.0 extension (OpenID Connect CIBA profile) enabling decoupled authentication where a client application requests authentication on behalf of a user via a back channel and the user approves the request through a separate device or channel. The affected products confirmed by CPE data are: Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign-On 7. The root cause is a missing authorization check - specifically, brute-force lockout status is not evaluated at the token redemption endpoint (/token endpoint with grant_type=urn:openid:params:grant-type:ciba), allowing an already-authorized auth_req_id to be exchanged for tokens even when the associated user account is locked. No CWE was assigned by the reporter, but this maps conceptually to CWE-863 (Incorrect Authorization) due to the incomplete enforcement of access control policy across all relevant code paths.
RemediationAI
Patch availability has not been confirmed with an exact fix version from the available references; a Red Hat vendor advisory exists at https://access.redhat.com/security/cve/CVE-2026-16103 and should be checked for updated package versions. Until a patch is applied, organizations using the CIBA flow should consider disabling Client-Initiated Backchannel Authentication entirely in Keycloak if not operationally required (this can be done per-realm by disabling the CIBA grant type on registered clients), as this eliminates the vulnerable code path with the trade-off of losing decoupled authentication for those clients. If CIBA must remain active, enforce short-lived auth_req_id expiration windows and monitor token endpoint logs for redemption attempts tied to accounts under lockout. Administrators should also ensure brute-force lockout thresholds are conservative and that account unlock procedures require re-authentication, limiting the window an approved CIBA request remains redeemable. Track Red Hat Bugzilla #2501736 for patch availability.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today