A flaw was found in Keycloak's Device Authorization Grant (RFC 8628) flow. The token redemption path in the DeviceGrantType class verifies the user.isEnabled status but fails to consult the BruteForceProtector to check for temporary lockouts. Because Keycloak's brute-force mechanism does not set the enabled flag to false during a temporary lockout, a locked user successfully passes the check. An attacker who possesses a surviving SSO browser session for a target account (established before the lockout) can complete the device verification and consent flow without being prompted for re-authentication. Consequently, the token endpoint issues a valid access token and refresh token while the account remains in a brute-force-locked state. This vulnerability represents a failure to include the Device Authorization Grant path in the fixes previously implemented for CIBA (CVE-2026-9798 and CVE-2026-16103).