CVE-2026-109082
6.8MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Attackers can compromise user accounts by tricking victims into approving unauthorized backchannel login requests. Exploitation requires network access to the Keycloak instance and user interaction, but does not require a client secret.
Root cause
Keycloak's keycloak-services component fails to verify whether a client is authorized to initiate the Client-Initiated Backchannel Authentication (CIBA) flow, allowing public clients to bypass authorization checks.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to the patched version of Keycloak once provided in the vendor advisory, or disable the CIBA authentication flow and disallow public clients from initiating backchannel requests.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.