CVE-2026-9798: Keycloak Account Lockout Bypass via CIBA Flow

Technical summary

CVE-2026-9798 describes an authentication bypass in Keycloak's CIBA implementation. The vulnerability arises from insufficient enforcement of account lockout policies within the CIBA flow. When a user account is transitioned to a locked state via the standard login flow (due to CWE-305: Using the Wrong API), the CIBA backchannel authentication handler does not respect or enforce the same lockout state. An attacker with valid OAuth client credentials can exploit this inconsistency to issue authentication requests and potentially obtain tokens on behalf of the locked account, effectively bypassing the intended brute-force mitigation.

Business impact

Organizations relying on Keycloak for user authentication and account security may experience reduced effectiveness of their brute-force defenses. Attackers who obtain valid client credentials—through credential compromise, insider threat, or misconfiguration—gain a secondary attack vector to continue unauthorized authentication attempts even after legitimate users' accounts are locked. This extends the window of opportunity for account takeover and may increase the blast radius of compromised service credentials across federated systems.

Affected systems

Red Hat Build of Keycloak is explicitly affected. The vulnerability applies to deployments where CIBA flow is enabled and where attackers can obtain valid client credentials. Organizations using Keycloak in identity provider or service-to-service authentication roles should assess their client credential inventory and CIBA usage. Patch availability and specific affected version ranges should be verified against Red Hat's security advisories.

Exploitability

Exploitation requires two preconditions: the attacker must possess valid client credentials (CVSS PR:N is notated but context indicates client auth requirement), and the target account must be in a locked state. The attack is network-accessible with low complexity. While not currently tracked as actively exploited in the KEV catalog, the attack is technically straightforward once initial access to client credentials is established, making it moderately concerning in environments where credential hygiene is weak.

Remediation

Apply security updates from Red Hat that enforce account lockout policies consistently across all authentication flows, including CIBA. Verify patch availability and version numbers through Red Hat's official security advisories. Additionally, conduct an inventory of OAuth client credentials in use; revoke or rotate any that are suspected of compromise or have excessive permissions. Consider implementing network-level controls to restrict CIBA endpoints or require step-up authentication for sensitive operations.

Patch guidance

Monitor Red Hat's security advisories for Keycloak patches addressing CVE-2026-9798. Test patches in a non-production environment to ensure compatibility with your CIBA configuration and dependent applications. Prioritize patching systems where CIBA is actively used or where service-to-service authentication is critical. Verify that the patch enforces account lockout state checks before issuing CIBA tokens.

Detection guidance

Monitor Keycloak authentication logs for anomalous patterns: repeated CIBA flow requests from a single client credential against locked accounts, or successful token issuance for locked accounts via CIBA when standard login attempts are blocked. Implement alerting on account lockout events followed by CIBA authentication attempts within a short time window. Review client credential usage logs for unexpected or elevated activity, particularly during or shortly after account security incidents.

Why prioritize this

Although CVSS is rated MEDIUM (4.3), the vulnerability merits prioritization in environments where Keycloak is the primary authentication service and CIBA is enabled for high-value integrations. The impact is compounded if client credentials are widely distributed or if account lockout is a primary brute-force defense. Organizations with strong client credential management and limited CIBA usage may defer to a secondary priority.

Risk score, explained

CVSS 4.3 reflects low confidentiality impact, network accessibility, and low complexity, but also acknowledges that user interaction or valid credentials are required. The score does not capture the context-dependent business risk: in organizations with weak credential governance, this vulnerability could facilitate account takeover of sensitive accounts (including administrative accounts) that would justify higher internal risk ratings.

Frequently asked questions