Vulnerability · Published Nov 5, 2026 · Assigned by redhat

CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens

Medium 6.8

In plain English

A medium-severity improper input validation in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 74.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://access.redhat.com/security/cve/CVE-2026-97174 vdb-entry, x_refsource_REDHAT
RHBZ#2539961 issue-tracking, x_refsource_REDHAT