Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A flaw in its brute-force protection mechanism allows an attacker to bypass account lockouts under specific conditions. If an attacker initiates a login request before a user's account is locked and the user subsequently approves it, the attacker can still obtain access tokens even if the account has since been locked due to suspicious activity.
Technical details
This vulnerability is an incomplete fix for CVE-2026-9798. While brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler, they were omitted from the token redemption handler in CibaGrantType.java. An attacker with valid client credentials can exploit this by initiating a CIBA request before a target account is locked. If the account is subsequently locked due to brute-force protection but the user approves the original request, the attacker can redeem the token and bypass the lockout. This requires network access and user interaction (approval of the CIBA request).
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-17: disclosed: Vulnerability published to NVD and Red Hat Bugzilla