A flaw in the keycloak-services component of Keycloak allows an attacker with valid client credentials to bypass brute-force protection on user accounts locked due to repeated failed authentication attempts. This occurs because brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but omitted from the token redemption handler. An attacker can obtain access and refresh tokens for a locked user account if the authentication request was started before the lockout and approved by the user.