Description

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-10-12T07:16:36.303Z",
  "pubdate": "2026-10-12T07:16:36.303Z",
  "executiveSummary": "A critical security flaw exists in the Client-Initiated Backchannel Authentication (CIBA) implementation within Keycloak's keycloak-services component. This vulnerability stems from an improper authorization check where the system fails to validate whether a client is explicitly permitted to utilize the CIBA flow.\nThe vulnerability allows public clients to bypass intended security controls, effectively circumventing the requirement for a client secret. By abusing this flaw, an unauthorized actor can initiate an authentication request on behalf of a victim, forcing a user to approve a malicious login prompt.\nSuccessful exploitation results in full account compromise, granting the attacker unauthorized access to the victim's account without the prerequisite credentials typically enforced for secure authentication. This poses a significant risk to the integrity and confidentiality of user accounts within affected Keycloak deployments.\nExploitation does not require prior administrative privileges, although it necessitates interaction with the target user to approve the backchannel request. Organizations relying on CIBA for delegated authentication are at high risk until patches or specific configuration mitigations are applied.",
  "technicalDetails": "The vulnerability resides within the keycloak-services component, specifically within the logic responsible for processing incoming CIBA authentication requests. The root cause is a failure in the authorization layer to enforce client-specific policy checks for the CIBA grant type.\nIn a secure CIBA implementation, the Authorization Server must verify that the requesting client has been registered and authorized to use the 'backchannel_authentication_endpoint'. Keycloak's implementation fails to validate this 'authorized' status, permitting any client—including those designated as 'public'—to initiate a backchannel authentication flow.\nThe attack flow proceeds as follows: First, the attacker identifies a Keycloak instance supporting CIBA. Second, the attacker sends a POST request to the CIBA backchannel authentication endpoint using a public client identifier. Because the server skips the authorization check, it accepts the request despite the client lacking the appropriate credentials or permissions.\nThird, the Keycloak server proceeds to trigger the backchannel notification to the targeted user. This usually manifests as a push notification or a secondary authentication request on the user's registered device or application. Fourth, if the user—misled or unaware of the malicious origin—approves the login request, the authentication process completes.\nFinally, the attacker receives the resulting tokens (ID, access, or refresh tokens) from the token endpoint using the information obtained from the CIBA flow. Because no client secret was required for the public client, the attacker successfully impersonates the user. This bypasses the security requirements that would normally prevent unauthenticated or unauthorized third-party clients from initiating such sensitive flows.\nThe scope of this vulnerability is limited to the CIBA protocol handler within the keycloak-services package. It impacts all versions where this flawed logic persists and requires the CIBA feature to be enabled and exposed to the network. The exploitation is entirely remote, requiring no internal network access, provided the CIBA endpoint is reachable."
}