CVE-2026-109082 in Keycloak
Summary
by MITRE • 10/12/2026
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Keycloak involves a critical authentication logic error within the Client-Initiated Backchannel Authentication CIBA implementation found in the keycloak-services component. This specific feature is designed to facilitate advanced authentication flows where an external client application initiates a login process on behalf of a user, typically by prompting the user to approve the request via their device or identity provider interface. The core technical flaw stems from insufficient authorization checks during this initiation phase. Specifically, Keycloak fails to verify whether the requesting client is authorized to utilize the CIBA flow before processing the authentication request. This oversight allows public clients, which do not possess a confidential client secret required for standard OAuth 2.0 flows, to bypass security requirements intended to restrict such sensitive operations to trusted, authenticated entities.
From an operational perspective, this misconfiguration creates a severe pathway for account takeover attacks. An attacker can exploit this flaw by registering or using a public client application that lacks the necessary credentials typically required for secure authentication exchanges. By leveraging the CIBA endpoint without proper validation of the client's authorization status, the attacker can trigger login requests that appear legitimate to the user interface. The victim is then prompted to approve what appears to be a standard access request from an authorized service. Once the user approves this maliciously crafted request, Keycloak issues valid authentication tokens to the attacker-controlled public client. This effectively grants the attacker full access to the user's account without ever needing to obtain or guess a client secret, completely undermining the intended security model of the backchannel flow.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to correctly establish and verify the identity of the entity initiating the authentication process. Furthermore, it relates to CWE-345 Insufficient Verification of Data Authenticity because the server accepts requests from unverified public clients that should have been rejected based on their lack of confidential credentials. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1078 Valid Accounts and specifically leverages aspects of T1621 Multi-Factor Authentication Interception by tricking the user into providing implicit approval for unauthorized access. The attack vector is primarily remote and requires no prior authentication from the attacker against Keycloak itself, relying instead on social engineering to get the victim to approve the fraudulent login attempt.
To mitigate this risk, administrators must ensure that their Keycloak deployments are updated to a version where this authorization check has been properly implemented. Until an official patch is available or applied, organizations should restrict access to CIBA endpoints by configuring network-level firewalls or reverse proxy rules to only allow requests from known and trusted client IP addresses if the feature is strictly necessary for specific use cases. Additionally, enforcing strict Client Authentication requirements in Keycloak realm settings can help prevent public clients from initiating sensitive flows that require higher assurance levels. It is also advisable to review audit logs for unusual patterns of CIBA initiation attempts originating from unregistered or unexpected client identifiers, as this may indicate active exploitation of the flaw.