Is CVE-2026-16103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16103 being exploited in the wild.

How severe is CVE-2026-16103?

Medium severity, with a CVSS score of 4.3, published 17 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak unspecified.

Is there a fix for CVE-2026-16103?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16103 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16103?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16103: Red Hat Keycloak brute-force protection bypass in CIBA token redemption

CVE-2026-16103 · Severity: medium · CVSS 4.3 · Published 2026-07-17

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A flaw in its brute-force protection mechanism allows an attacker to bypass account lockouts under specific conditions. If an attacker initiates a login request before a user's account is locked and the user subsequently approves it, the attacker can still obtain access tokens even if the account has since been locked due to suspicious activity.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-16103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16103 being exploited in the wild.
How severe is CVE-2026-16103?: Medium severity, with a CVSS score of 4.3, published 17 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-16103?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16103 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16103?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an incomplete fix for CVE-2026-9798. While brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler, they were omitted from the token redemption handler in CibaGrantType.java. An attacker with valid client credentials can exploit this by initiating a CIBA request before a target account is locked. If the account is subsequently locked due to brute-force protection but the user approves the original request, the attacker can redeem the token and bypass the lockout. This requires network access and user interaction (approval of the CIBA request).

Affected products

Red Hat Red Hat Build of Keycloak unspecified

Timeline

2026-07-17: disclosed: Vulnerability published to NVD and Red Hat Bugzilla

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.