Bug 2501736 (CVE-2026-16103)

Summary:	CVE-2026-16103 keycloak-services: keycloak-services: Incomplete fix for CIBA brute-force lockout bypass at token redemption
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-17 14:47:20 UTC

The vulnerability is a protection mechanism failure resulting from an incomplete fix for CVE-2026-9798. The original mitigation added a BruteForceProtector check to the CIBA initiation handler in BackchannelAuthenticationEndpoint.java but did not implement a corresponding check in the CIBA token redemption handler (CibaGrantType.java).
Exploitation requires the following conditions:
The attacker must possess valid client credentials for a CIBA-enabled client.

A CIBA authentication request must be initiated while the target account is still unlocked.

The target account must then be driven into a temporary brute-force lockout state.

The legitimate account owner must approve the pending CIBA request on their authentication device.

The attacker redeems the pre-lockout auth_req_id at the token endpoint within the CIBA expiry window.


Successful exploitation allows an attacker to receive valid access and refresh tokens for a locked account, bypassing the intended brute-force protection policy.