PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9798 Red Hat CVE debrief

A flaw in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows attackers with valid client credentials to bypass brute-force protection on temporarily locked accounts. When an account is locked due to repeated failed login attempts, the CIBA flow continues to permit authentication attempts and token issuance, undermining the intended account lockout security control. This vulnerability has a CVSS 3.1 score of 4.3 (MEDIUM severity) and was published on May 28, 2026. The weakness is categorized as CWE-305: Authentication Bypass by Primary Weakness. Organizations using Keycloak with CIBA enabled should monitor for updates from Red Hat and Keycloak maintainers regarding patches that enforce brute-force protection checks within the CIBA authentication flow.

Vendor
Red Hat
Product
Red Hat Build of Keycloak
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-08-20
Advisory published
2026-05-28
Advisory updated
2026-08-20

Who should care

Organizations using Keycloak for identity and access management, particularly those with CIBA-enabled applications or high-security authentication requirements. Security teams responsible for brute-force protection and authentication flow security. Developers implementing CIBA-based authentication solutions.

Technical summary

The vulnerability exists in Keycloak's implementation of Client-Initiated Backchannel Authentication (CIBA), an OAuth 2.0 extension for decoupled authentication. The brute-force protection mechanism that temporarily locks accounts after repeated failed login attempts is not properly enforced during CIBA flows. An attacker possessing valid client credentials can continue to initiate authentication requests and obtain tokens for a locked account, effectively bypassing the account lockout security control. This requires the attacker to have already obtained valid client credentials through other means, limiting the attack to scenarios where client compromise has occurred.

Defensive priority

medium

Recommended defensive actions

  • Review Keycloak CIBA configuration and assess exposure to brute-force attacks via this authentication flow
  • Monitor Red Hat Security Advisories and Keycloak security updates for patches addressing CVE-2026-9798
  • Implement additional rate limiting or monitoring on CIBA endpoints as a compensating control until patches are available
  • Audit authentication logs for anomalous CIBA authentication patterns that may indicate exploitation attempts

Evidence notes

Vulnerability description sourced from NVD record with references to Red Hat Security and Bugzilla. CVSS vector confirms network attack vector with low attack complexity. Vendor attribution to Keycloak based on description content; vendor field marked for review due to 'Unknown Vendor' classification in source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9798 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9798

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9798 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9798

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.