Executive brief
Keycloak is an open-source tool used by organizations to manage user identities and secure access to applications. A security flaw was found where an attacker could continue attempting to log into a user's account even after the account was supposed to be locked due to too many failed password attempts. This bypasses a critical security feature designed to prevent hackers from guessing passwords, potentially allowing unauthorized access to user accounts.
Technical details
A vulnerability exists in Keycloak's implementation of the Client-Initiated Backchannel Authentication (CIBA) flow. The CIBA authentication endpoint fails to verify the account lockout status (brute-force protection) before processing requests. An attacker with valid client credentials can initiate a CIBA flow against a user account that has been temporarily locked due to repeated failed login attempts. If the user subsequently approves the request on their authentication device, Keycloak issues valid tokens, effectively bypassing the brute-force protection mechanism enforced on other grant types. The issue is rooted in the `BackchannelAuthenticationEndpoint` failing to check if a user is disabled or locked. Fixes involve adding brute-force checks to the CIBA backchannel authentication logic.
Affected products
- Keycloak Keycloak <= 26.4.7, >= 26.5.0, <= 26.6.4
Timeline
- 2026-05-28: disclosed: Initial disclosure and NVD publication
- 2026-05-28: advisory: GitHub Advisory GHSA-q6h7-xxp7-7429 published
- 2026-06-11: patched: Fix merged into main branch via PR #49791