A vulnerability in Red Hat Build of Keycloak allows bypassing of brute-force protection mechanisms when a user account is temporarily locked after repeated failed login attempts. Specifically, an attacker possessing valid client credentials can exploit the CIBA authentication flow to continue authentication attempts and receive tokens despite the account lockout. This flaw could enable attackers to persist in unauthorized access attempts. The CVSS v3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity, no privileges required, and requiring user interaction. The vulnerability does not impact integrity or availability.

The vulnerability allows attackers to circumvent account lockout protections designed to prevent brute-force attacks by exploiting the CIBA flow with valid client credentials. This may lead to continued authentication attempts and token issuance even when the account should be locked, potentially increasing the risk of unauthorized access. However, the impact is limited to confidentiality with no direct effect on integrity or availability. There are no known exploits in the wild at this time.

The vendor advisory does not specify an official fix or patch availability. Patch status is not yet confirmed—users should monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9798 for updates on remediation. Until a fix is available, organizations should consider restricting client credentials to trusted parties and monitor authentication flows for unusual activity related to CIBA. No vendor guidance indicates that no action is required or that the issue is already mitigated.