A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed.
An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.