CVE-2026-109082
Received Received - Intake

Keycloak CIBA Authentication Bypass Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: redhat-SADP

Description
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109082
EUVD
EUVD-2026-97260

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Build of Keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's Client-Initiated Backchannel Authentication (CIBA) implementation. It allows public clients to bypass security checks and initiate login flows for users without proper authorization. Attackers can trick users into approving login requests via push notifications, gaining full account access without needing a client secret.

Detection Guidance

To detect this vulnerability, check Keycloak server logs for unauthorized CIBA flow initiation attempts by public clients. Look for login-hint parameters with public client IDs and push notification approvals from unexpected sources. Monitor token endpoint requests for auth-req-id redemption by public clients.

Impact Analysis

If exploited, an attacker could gain full access to your account by tricking you into approving a login request. They could then perform actions or access data as you, including private information. Exploitation requires user interaction, such as approving a push notification on an authentication device.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. Unauthorized access may result in data breaches, triggering legal and regulatory penalties.

Mitigation Strategies

Immediate mitigation requires disabling the CIBA flow in Keycloak configuration until a patch is available. Restrict access to the backchannel-authentication and token endpoints to confidential clients only. Review and revoke any suspicious user sessions or tokens issued during potential exploitation periods.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart