CVE-2026-9798
Medium · 4.3CVSS
4.3
EPSS
0.5%
Published
May 28, 2026
CISA due date
—
The record
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic… CWE-305
- CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in… CWE-305
- CVE-2026-16895 A logic vulnerability (fail-open condition) has been identified within the Metasploit… CWE-305
- CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-305
- CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from… CWE-305
- CVE-2026-1621 Authentication bypass by primary weakness vulnerability in Universal Software Inc. CWE-305
- CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by… CWE-305
- CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making… CWE-305