A vulnerability in Red Hat Build of Keycloak allows bypassing brute-force protection mechanisms when user accounts are locked after repeated failed login attempts. Specifically, during the CIBA flow, an attacker possessing valid client credentials can continue authentication attempts and obtain tokens despite the account lockout state. This issue arises from improper enforcement of account lockout during the backchannel authentication process. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The vulnerability permits attackers with valid client credentials to circumvent account lockout protections, potentially enabling continued brute-force attempts or unauthorized token issuance. This could lead to increased risk of unauthorized access to user accounts. However, the impact is limited to confidentiality with no direct integrity or availability effects. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9798 for current remediation guidance. Until an official fix is available, organizations should monitor for unusual authentication activity involving the CIBA flow and consider additional compensating controls such as restricting client credentials or enhancing monitoring around authentication attempts. No vendor advisory indicates that no action is required or that the issue is already mitigated.