REDHAT-BUG-2531302: Medium severity Keycloak Device Authorization Grant flow (RFC 8628) / DeviceGrantType vulnerability
A flaw was found in Keycloak's Device Authorization Grant (RFC 8628) flow. The token redemption path in the DeviceGrantType class verifies the user.isEnabled status but fails to consult the BruteForceProtector to check for temporary lockouts. Because Keycloak's brute-force mechanism does not set the enabled flag to false during a temporary lockout, a locked user successfully passes the check. An attacker who possesses a surviving SSO browser session for a target account (established before the lockout) can complete the device verification and consent flow without being prompted for re-authentication. Consequently, the token endpoint issues a valid access token and refresh token while the account remains in a brute-force-locked state. This vulnerability represents a failure to include the Device Authorization Grant path in the fixes previously implemented for CIBA (CVE-2026-9798 and CVE-2026-16103).
Affected Software
Event History
Frequently Asked Questions
What must an attacker have to obtain tokens during a temporary brute-force lockout?
The attacker must possess a surviving SSO browser session for the target account that was established before the lockout. They can then complete device verification and consent without being prompted to authenticate again.
Does a temporary brute-force lockout prevent token issuance through this flow?
No. The affected redemption path checks whether the user is enabled but does not consult the brute-force protection state, so a temporarily locked account can still receive valid access and refresh tokens through the device authorization flow.