CVE-2026-9798

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-25)

CWE

CWE-305

Published

2026-05-28

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• redhat:build_of_keycloak

Packages (OSV)

References

• https://access.redhat.com/errata/RHSA-2026:50846
• https://access.redhat.com/errata/RHSA-2026:50847
• https://access.redhat.com/errata/RHSA-2026:50848
• https://access.redhat.com/errata/RHSA-2026:50849
• https://access.redhat.com/security/cve/CVE-2026-9798

Check your stackJSON