This vulnerability in Red Hat Build of Keycloak arises from an incomplete fix for CVE-2026-9798. While brute-force protection checks were implemented in the Client-Initiated Backchannel Authentication (CIBA) initiation handler, these checks were omitted in the token redemption handler. As a result, an attacker possessing valid client credentials can redeem tokens for a user account that has been locked due to brute-force protection, provided the authentication request was initiated before the lockout and approved by the user. This issue affects the keycloak-services component and is classified under CWE-841 (Improper Enforcement of Behavioral Workflow).

The vulnerability allows an attacker with valid client credentials to bypass brute-force lockout protections during token redemption, potentially obtaining access and refresh tokens for a locked user account. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact. The CVSS score is 4.3 (medium severity), reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16103 for current remediation guidance. No official fix or temporary workaround is explicitly stated in the provided advisory content. Until a patch is available, monitor vendor updates closely and consider restricting client credentials or CIBA usage if feasible.