CVE-2026-16103: Keycloak Auth Bypass Vulnerability

CVE-2026-16103 Overview

CVE-2026-16103 affects the keycloak-services component of Keycloak. The flaw is an incomplete fix for CVE-2026-9798. Brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but omitted from the token redemption handler. An attacker with valid client credentials can obtain access and refresh tokens for a user account already locked by brute-force protection. Exploitation requires that the authentication request was started before lockout and was approved by the user. The vulnerability is tracked under [CWE-841: Improper Enforcement of Behavioral Workflow].

Critical Impact
Attackers holding valid client credentials can bypass account lockout enforcement and mint OAuth tokens for locked user accounts through the CIBA token redemption path.

Affected Products

Keycloak (keycloak-services component)
Red Hat build of Keycloak (per Red Hat advisory)
Downstream distributions embedding vulnerable Keycloak releases

Discovery Timeline

2026-07-17 - CVE-2026-16103 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16103

Vulnerability Analysis

Keycloak implements brute-force protection to lock user accounts after repeated failed authentication attempts. CVE-2026-9798 previously exposed a gap where CIBA flows did not honor lockout state. The remediation added protection checks to the CIBA initiation handler. However, the token redemption handler, which exchanges an approved authentication request for tokens, was not updated. An attacker who initiates a CIBA authentication request, waits for user approval, then redeems the resulting artifact can bypass any lockout that occurs between approval and redemption. The result is issuance of access and refresh tokens for an account that policy considers locked.

Root Cause

The root cause is inconsistent enforcement of the brute-force lockout state across the multi-step CIBA workflow. The initiation handler validates account status, while the redemption handler assumes prior validation is sufficient. This behavioral workflow enforcement gap maps to [CWE-841]. The incomplete fix for CVE-2026-9798 addressed the entry point but did not close the exit path.

Attack Vector

Exploitation requires network access to the Keycloak token endpoint, valid OAuth client credentials, and a CIBA request already approved by the target user. The attacker initiates a CIBA flow, obtains user approval, and delays token redemption until the account is locked by other failed attempts. The attacker then calls the token redemption handler and receives valid access and refresh tokens despite the active lockout. User interaction is required at approval time, which limits opportunistic use but does not prevent targeted abuse.

No public proof-of-concept exploit is available. Technical details are documented in the Red Hat CVE Advisory and the Red Hat Bug Report.

Detection Methods for CVE-2026-16103

Indicators of Compromise

Successful CIBA token redemption events for user accounts in a LOCKED_OUT state in Keycloak brute-force logs.
Access or refresh tokens issued shortly after a brute-force lockout was triggered for the same user subject.
Repeated failed authentication events for a user followed by a successful CIBA token grant from a confidential client.

Detection Strategies

Correlate Keycloak USER_LOGIN_FAILURE and brute-force lockout events with subsequent CIBA token issuance events for the same userId.
Alert on any token issuance where the associated user account has an active disabled or bruteForce flag at the time of redemption.
Monitor OAuth client credential usage patterns for clients redeeming CIBA tokens against locked users.

Monitoring Recommendations

Enable Keycloak event logging for LOGIN, LOGIN_ERROR, and CIBA-specific events, then forward to a centralized SIEM.
Track token issuance latency between CIBA approval and redemption; unusually long delays followed by successful redemption warrant review.
Baseline confidential client behavior and flag deviations in CIBA grant volume or timing.

How to Mitigate CVE-2026-16103

Immediate Actions Required

Apply the vendor-supplied Keycloak update that adds brute-force protection checks to the CIBA token redemption handler when it becomes available.
Audit confidential clients permitted to use CIBA and revoke credentials for any client not required to use this flow.
Review recent CIBA token issuance events against brute-force lockout logs and revoke tokens issued to locked accounts.

Patch Information

Refer to the Red Hat CVE Advisory for fixed package versions and errata. Track the upstream fix through the Red Hat Bug Report. Upgrade Keycloak to a release that enforces brute-force protection in both the CIBA initiation and token redemption handlers.

Workarounds

Disable the CIBA authentication flow for clients that do not require it until patched builds are deployed.
Shorten the CIBA request lifetime so approved requests expire before a plausible lockout window.
Restrict CIBA-enabled clients to a minimal set and enforce strict client authentication using mTLS or signed JWT client assertions.

bash

# Configuration example: disable CIBA grant for a Keycloak client via kcadm
kcadm.sh update clients/<CLIENT_UUID> -r <REALM> \
  -s 'attributes."oidc.ciba.grant.enabled"=false'

# Reduce CIBA request lifetime (seconds) at the realm level
kcadm.sh update realms/<REALM> \
  -s 'attributes."cibaExpiresIn"=60'