# CVE-2026-16103: Red Hat Keycloak brute-force protection bypass in CIBA token redemption

Source: https://junglewise.ai/threats/cve-2026-16103-red-hat-keycloak-brute-force-protection-bypass-in-ciba-token  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-16103 · Severity: medium · CVSS 4.3 · Published 2026-07-17

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A flaw in its brute-force protection mechanism allows an attacker to bypass account lockouts under specific conditions. If an attacker initiates a login request before a user's account is locked and the user subsequently approves it, the attacker can still obtain access tokens even if the account has since been locked due to suspicious activity.

Technologies: [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-16103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16103 being exploited in the wild.

**How severe is CVE-2026-16103?** Medium severity, with a CVSS score of 4.3, published 17 July 2026.

**Which products and versions are affected?** Red Hat build of Keycloak unspecified.

**Is there a fix for CVE-2026-16103?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16103 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16103?** Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an incomplete fix for CVE-2026-9798. While brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler, they were omitted from the token redemption handler in CibaGrantType.java. An attacker with valid client credentials can exploit this by initiating a CIBA request before a target account is locked. If the account is subsequently locked due to brute-force protection but the user approves the original request, the attacker can redeem the token and bypass the lockout. This requires network access and user interaction (approval of the CIBA request).

## Affected products

- Red Hat Red Hat Build of Keycloak unspecified

## Timeline

- 2026-07-17: disclosed: Vulnerability published to NVD and Red Hat Bugzilla

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/security/cve/CVE-2026-16103](https://access.redhat.com/security/cve/CVE-2026-16103)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2501736](https://bugzilla.redhat.com/show_bug.cgi?id=2501736)

## Related threats

- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Red Hat Build of Keycloak OIDC logout session fixation](https://junglewise.ai/threats/cve-2026-107124-a-flaw-was-found-in-the-oidc-logout-endpoint-of-the-keycloak)
- [Keycloak theme resource disk exhaustion](https://junglewise.ai/threats/cve-2026-110932-a-flaw-was-found-in-the-theme-resource-endpoint-of-keycloak-an)
- [Keycloak secure-redirect-uris-enforcer open redirect via DNS resolution](https://junglewise.ai/threats/cve-2026-118425-a-flaw-was-found-in-the-secure-redirect-uris-enforcer-client)
- [Keycloak OIDC Dynamic Client Registration offline token revocation bypass](https://junglewise.ai/threats/cve-2026-107623-a-flaw-was-found-in-the-oidc-dynamic-client-registration-dcr)