A vulnerability in Keycloak's Client-Initiated Backchannel Authentication (CIBA) implementation allows an attacker to manipulate the 'sub' parameter. This flaw causes the injected 'sub' value to overwrite the legitimate subject identifier during token issuance, enabling attackers to receive tokens for victim users. The issue leads to unauthorized access to victim accounts without their knowledge or interaction. Red Hat has assessed this vulnerability as Important due to its potential for privilege escalation and unauthorized access. Currently, no effective mitigation or patch meeting Red Hat's criteria is available.