PT-2026-44193 · Red Hat · Keycloak

Published 2026-05-28 · Updated 2026-06-03 · CVE-2026-9798

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the Client-Initiated Backchannel Authentication (CIBA) flow allows an attacker with valid client credentials to bypass brute-force protection. When a user account is temporarily locked following repeated failed login attempts, this mechanism can be exploited to continue authentication attempts and obtain token issuance, potentially leading to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2026-9798

GHSA-Q6H7-XXP7-7429

Affected Products

Keycloak

References · 13

• https://osv.dev/vulnerability/GHSA-q6h7-xxp7-7429 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2482470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9798 · Security Note
• https://access.redhat.com/security/cve/CVE-2026-9798 · Vendor Advisory
• https://github.com/keycloak/keycloak/commit/11c2695064cd93da1d333df3f69d4a4141e86c29 · Note
• https://github.com/keycloak/keycloak/commit/a11e3254efc16ae72ce5092b93b9f557a4ba43ae · Note
• https://github.com/keycloak/keycloak/pull/49903 · Note
• https://github.com/keycloak/keycloak/pull/49905 · Note
• https://github.com/keycloak/keycloak/issues/49432 · Note
• https://github.com/keycloak/keycloak/commit/2edc6b112e2dedce63062b89ab3c7ae542e0d9ac · Note
• https://github.com/keycloak/keycloak/pull/49791 · Note
• https://github.com/keycloak/keycloak · Note
• https://twitter.com/dailycve/status/2062316170263290320 · Twitter Post