Flaw in Keycloak's CIBA Implementation Allows Unauthorized User Access
CVE-2026-97174
6.8MEDIUM
What is CVE-2026-97174?
A significant flaw has been identified in the Client-Initiated Backchannel Authentication (CIBA) process of Keycloak. The vulnerability arises as the CIBA endpoint lacks proper validation for the 'sub' parameter, which can be stored as an additional request parameter. This weakness allows an attacker during the token issuance phase to inject a malicious value that can overwrite the legitimate subject identifier. Consequently, this enables an attacker to authenticate as themselves while gaining security tokens intended for another user, leading to potential unauthorized access to that user’s account.
References
CVSS V3.1
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Amr Al Hallak (v4yne1) for reporting this issue.