CVE-2026-9798 is an authentication bypass vulnerability in Red Hat build of Keycloak 26.4 related to the Client-Initiated Backchannel Authentication (CIBA) flow. When a user account is locked due to repeated failed login attempts, an attacker possessing valid client credentials can exploit the CIBA flow to circumvent the brute-force protection mechanism. This flaw allows continued authentication attempts and token issuance even though the account should be locked. The vulnerability is rated with a CVSS 3.1 base score of 4.3 (medium severity) and requires that CIBA be explicitly enabled and configured, which is not the default setting in Red Hat deployments. The user must also approve the authentication request on their device for the bypass to be successful, significantly limiting the practical attack surface.

The impact is limited to bypassing brute-force protection on locked user accounts via the CIBA flow, potentially allowing continued authentication attempts and token issuance. Confidentiality impact is low, with no integrity or availability impact reported. The vulnerability only affects deployments where CIBA is enabled and configured, which is not the default in Red Hat's Keycloak builds. There are no known exploits in the wild at this time.

Red Hat advises ensuring that Client-Initiated Backchannel Authentication (CIBA) is not enabled in Keycloak realms unless explicitly required. If CIBA is enabled, it is recommended to disable it to prevent bypass of brute-force protection. Administrators should consult Keycloak documentation for managing CIBA configuration. No official patch or fix is currently indicated in the advisory; mitigation relies on configuration management.