CVE-2026-16103: Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.
Other sources
The vulnerability is a protection mechanism failure resulting from an incomplete fix for CVE-2026-9798. The original mitigation added a BruteForceProtector check to the CIBA initiation handler in BackchannelAuthenticationEndpoint.java but did not implement a corresponding check in the CIBA token redemption handler (CibaGrantType.java). Exploitation requires the following conditions: The attacker must possess valid client credentials for a CIBA-enabled client.
A CIBA authentication request must be initiated while the target account is still unlocked.
The target account must then be driven into a temporary brute-force lockout state.
The legitimate account owner must approve the pending CIBA request on their authentication device.
The attacker redeems the pre-lockout authreqid at the token endpoint within the CIBA expiry window.
Successful exploitation allows an attacker to receive valid access and refresh tokens for a locked account, bypassing the intended brute-force protection policy.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16103?
CVE-2026-16103 has a severity rating of medium with a score of 4.3.
What does CVE-2026-16103 affect?
CVE-2026-16103 affects the keycloak-services component of Keycloak.
How does CVE-2026-16103 impact security?
CVE-2026-16103 allows a brute-force lockout bypass at the token redemption stage, potentially compromising security.
How do I fix CVE-2026-16103?
To address CVE-2026-16103, ensure your Keycloak instance is updated to a version where this flaw is patched.
Is CVE-2026-16103 related to any other vulnerabilities?
Yes, CVE-2026-16103 is related to CVE-2026-9798, as it represents an incomplete fix for that earlier vulnerability.