Bug 2531302 (CVE-2026-88770) - CVE-2026-88770 keycloak-services: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts
Summary: CVE-2026-88770 keycloak-services: keycloak-services: Device Authorization Gra...
Keywords:
Status: NEW
Alias: CVE-2026-88770
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-10 07:06 UTC by OSIDB Bzimport
Modified: 2026-09-10 07:06 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-10 07:06:13 UTC 
A flaw was found in Keycloak's Device Authorization Grant (RFC 8628) flow. The token redemption path in the DeviceGrantType class verifies the user.isEnabled status but fails to consult the BruteForceProtector to check for temporary lockouts. Because Keycloak's brute-force mechanism does not set the enabled flag to false during a temporary lockout, a locked user successfully passes the check.
An attacker who possesses a surviving SSO browser session for a target account (established before the lockout) can complete the device verification and consent flow without being prompted for re-authentication. Consequently, the token endpoint issues a valid access token and refresh token while the account remains in a brute-force-locked state. This vulnerability represents a failure to include the Device Authorization Grant path in the fixes previously implemented for CIBA (CVE-2026-9798 and CVE-2026-16103).
Note You need to log in before you can comment on or make changes to this bug.