Vulnerability · Published Jul 17, 2026 · Assigned by redhat

CVE-2026-16103Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Medium 4.3

In plain English

A medium-severity security flaw in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Data Grid 8	see references
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-305, CWE-841 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2026-16103 vdb-entry, x_refsource_REDHAT
RHBZ#2501736 issue-tracking, x_refsource_REDHAT