What’s Vulnerable › Vulnerabilities

CVE-2026-109082: Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-15
• Weakness: CWE-287

Description

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-109082
• https://bugzilla.redhat.com/show_bug.cgi?id=2549478

Get alerted when CVE-2026-109082 or the next vulnerability affects your stack