CVE-2026-109082: Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients
A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed. An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.
Other sources
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.
— MITRE