CVE-2026-109082: Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients
A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed. An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.
Other sources
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the CIBA grant are exposed if a public client can use the backchannel-authentication and token endpoints. Bearer-only clients are correctly rejected and are not affected by this specific bypass.
What does an attacker need to exploit it?
An attacker needs a public client identifier and a known target user that can be referenced through login-hint. The target user must approve the push notification on their authentication device; the attacker does not need a client secret or valid user credentials.
What is the impact after successful exploitation?
The attacker can redeem the auth-req-id for a valid access token for the approving user. That token can be used to access the user's private information and perform actions authorized to that user.
How can I identify potentially affected activity?
Look for CIBA backchannel authentication requests initiated by public clients that authenticate with only a client ID, followed by token redemption using the resulting auth-req-id. Approval of the associated push notification is required for the flow to produce a user access token.