CVE-2026-88770: Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
A flaw was found in Keycloak's Device Authorization Grant (RFC 8628) flow. The token redemption path in the DeviceGrantType class verifies the user.isEnabled status but fails to consult the BruteForceProtector to check for temporary lockouts. Because Keycloak's brute-force mechanism does not set the enabled flag to false during a temporary lockout, a locked user successfully passes the check. An attacker who possesses a surviving SSO browser session for a target account (established before the lockout) can complete the device verification and consent flow without being prompted for re-authentication. Consequently, the token endpoint issues a valid access token and refresh token while the account remains in a brute-force-locked state. This vulnerability represents a failure to include the Device Authorization Grant path in the fixes previously implemented for CIBA (CVE-2026-9798 and CVE-2026-16103).
Other sources
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a locked account, they can complete the device login process and receive new security tokens. This allows the attacker to maintain access to the account even when it should be temporarily disabled to prevent unauthorized entry.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Keycloak (keycloak-services)to a version that resolves this vulnerability.Patch CVE-2026-9798 - Upgrade
Upgrade
Keycloak (keycloak-services)to a version that resolves this vulnerability.Patch CVE-2026-16103
Event History
Frequently Asked Questions
What must an attacker have to exploit this issue?
The attacker needs a surviving SSO browser session for the target account that was established before the account entered its temporary brute-force lockout. They can then complete the device verification and consent flow without being prompted to authenticate again.
Which accounts are exposed?
Accounts that are temporarily locked by Keycloak's brute-force protection remain exposed if they have an active pre-existing SSO browser session. The issue does not apply merely because an account is locked; the attacker must also possess that surviving session.
What is the impact of a successful exploit?
The Device Authorization Grant token endpoint can issue valid access and refresh tokens even while the user account remains brute-force locked. This bypasses the intended protection of the temporary lockout for that grant flow.