CVE-2026-9798
🔶 mediumSummary
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.
CVSS Score
4.3
Medium
EPSS Score
0.1
Exploit Probability
Published Date
2026-05-28
First Seen: 2026-05-29
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 5.4% of all 326,604 vulnerabilities in our database.
#308,897
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 29, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Red Hat would like to thank Evan Hendra (Independent Security Researcher) for reporting this issue.
SSVC data provided by
CISA
Last Modified
2026-06-03
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE IDs (Weakness Types)