CVE-2026-9798: Keycloak brute-force protection bypass in CIBA flow

CVE-2026-9798 · Severity: medium · CVSS 4.3 · Published 2026-05-28

Keycloak is an open-source tool used by organizations to manage user identities and secure access to applications. A security flaw was found where an attacker could continue attempting to log into a user's account even after the account was supposed to be locked due to too many failed password attempts. This bypasses a critical security feature designed to prevent hackers from guessing passwords, potentially allowing unauthorized access to user accounts.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven). Vendors: Keycloak, Maven.

Quick answers

Is CVE-2026-9798 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9798 being exploited in the wild.
How severe is CVE-2026-9798?
Medium severity, with a CVSS score of 4.3, published 28 May 2026.
Which products and versions are affected?
Keycloak <= 26.4.7, >= 26.5.0, <= 26.6.4; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,last_affected=26.4.7.
Is there a fix for CVE-2026-9798?
A patch was published on 2026-06-11: Fix merged into main branch via PR #49791 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9798 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9798?
Check whether you run Keycloak or org.keycloak:keycloak-services (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Keycloak's implementation of the Client-Initiated Backchannel Authentication (CIBA) flow. The CIBA authentication endpoint fails to verify the account lockout status (brute-force protection) before processing requests. An attacker with valid client credentials can initiate a CIBA flow against a user account that has been temporarily locked due to repeated failed login attempts. If the user subsequently approves the request on their authentication device, Keycloak issues valid tokens, effectively bypassing the brute-force protection mechanism enforced on other grant types. The issue is rooted in the `BackchannelAuthenticationEndpoint` failing to check if a user is disabled or locked. Fixes involve adding brute-force checks to the CIBA backchannel authentication logic.

Affected products

  • Keycloak Keycloak <= 26.4.7, >= 26.5.0, <= 26.6.4

Identifiers

  • CVE-2026-9798
  • GHSA-q6h7-xxp7-7429

Timeline

  • 2026-05-28: disclosed: Initial disclosure and NVD publication
  • 2026-05-28: advisory: GitHub Advisory GHSA-q6h7-xxp7-7429 published
  • 2026-06-11: patched: Fix merged into main branch via PR #49791

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.