PatchSiren cyber security CVE debrief

CVE-2026-9798 Red Hat CVE debrief

A flaw in Keycloak's Client-Initiated Backchannel Authentication (CIBA) flow allows attackers with valid client credentials to bypass brute-force protection on temporarily locked accounts. When an account is locked due to repeated failed login attempts, the CIBA flow continues to permit authentication attempts and token issuance, undermining the intended account lockout security control. This vulnerability has a CVSS 3.1 score of 4.3 (MEDIUM severity) and was published on May 28, 2026. The weakness is categorized as CWE-305: Authentication Bypass by Primary Weakness. Organizations using Keycloak with CIBA enabled should monitor for updates from Red Hat and Keycloak maintainers regarding patches that enforce brute-force protection checks within the CIBA authentication flow.

Vendor: Red Hat
Product: Red Hat Build of Keycloak
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-28
Advisory published: 2026-05-28
Advisory updated: 2026-05-28

Who should care

Organizations using Keycloak for identity and access management, particularly those with CIBA-enabled applications or high-security authentication requirements. Security teams responsible for brute-force protection and authentication flow security. Developers implementing CIBA-based authentication solutions.

Technical summary

The vulnerability exists in Keycloak's implementation of Client-Initiated Backchannel Authentication (CIBA), an OAuth 2.0 extension for decoupled authentication. The brute-force protection mechanism that temporarily locks accounts after repeated failed login attempts is not properly enforced during CIBA flows. An attacker possessing valid client credentials can continue to initiate authentication requests and obtain tokens for a locked account, effectively bypassing the account lockout security control. This requires the attacker to have already obtained valid client credentials through other means, limiting the attack to scenarios where client compromise has occurred.

Defensive priority

medium

Recommended defensive actions

Review Keycloak CIBA configuration and assess exposure to brute-force attacks via this authentication flow
Monitor Red Hat Security Advisories and Keycloak security updates for patches addressing CVE-2026-9798
Implement additional rate limiting or monitoring on CIBA endpoints as a compensating control until patches are available
Audit authentication logs for anomalous CIBA authentication patterns that may indicate exploitation attempts

Evidence notes

Vulnerability description sourced from NVD record with references to Red Hat Security and Bugzilla. CVSS vector confirms network attack vector with low attack complexity. Vendor attribution to Keycloak based on description content; vendor field marked for review due to 'Unknown Vendor' classification in source data.

Official resources

public