CVE-2026-88770 is a vulnerability in Keycloak's Device Authorization Grant flow where the token redemption process fails to check if a user account is locked due to brute-force protection. An attacker holding an active session for a locked account can complete the device login process and receive new security tokens, effectively bypassing brute-force lockout mechanisms. The root cause is the missing brute-force status check in the token redemption code path. Red Hat has assessed this vulnerability as moderate severity (CVSS 6.5) and notes that exploitation requires a valid SSO session established prior to the account lockout. Currently, no mitigation or patch meeting Red Hat's standards for ease of use, applicability, or stability is available.

An attacker with a valid active session on a locked user account can bypass brute-force protection policies and obtain valid security tokens, maintaining unauthorized access even when the account should be temporarily disabled. The vulnerability impacts confidentiality by allowing unauthorized token issuance but does not affect integrity or availability. Exploitation requires prior access to an active session, limiting the attack scope.

Red Hat states that no mitigation or patch meeting their criteria for ease of use, widespread applicability, or stability is currently available. Users should monitor Red Hat advisories for future updates. Since exploitation requires an active session established before lockout, limiting session lifetimes and monitoring for unusual session activity may help reduce risk, but no official mitigation is provided.