CVE-2026-97174
Awaiting Analysis Awaiting Analysis - Queue

Keycloak CIBA Sub Parameter Injection Leading to Account Takeover

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: redhat-SADP

Description
A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-97174
EUVD
EUVD-2026-117610

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Build of Keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's Client-Initiated Backchannel Authentication (CIBA) feature. It allows an attacker to inject a malicious 'sub' parameter into CIBA requests. During token issuance, this injected value overwrites the legitimate subject identifier, causing the attacker to receive security tokens belonging to another user. This leads to unauthorized account access without the victim's knowledge.

Impact Analysis

An attacker could authenticate as themselves but gain access to another user's account and data. This includes obtaining access and ID tokens for any user in the affected system, potentially leading to unauthorized actions, data theft, or further compromise of user accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with privacy regulations, and potential legal or financial penalties due to compromised personal or health information.

Mitigation Strategies

No immediate mitigation steps are provided in the available resources. Red Hat states mitigation options are currently unavailable or do not meet criteria for ease of use, deployment, or stability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97174. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...