CVE-2026-109082

MediumCVSS 6.8/10Last modified Oct 15, 2026

Description

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	—
Red Hat	Red Hat Build of Keycloak	—
Red Hat	Red Hat Single Sign-On 7	—

References

Timeline

Published: Oct 12, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1090839.8Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrar CVE-2026-1090886.5A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback functi CVE-2026-1090897.5A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.CVE-2026-109098.3Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti CVE-2026-1090907.5A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.CVE-2026-1090917.8A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by m CVE-2026-1090927.8Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.CVE-2026-1090938.5A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be CVE-2026-1090948.5A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland before 24.1.15 and X S CVE-2026-1090956.9A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authentica CVE-2026-1090965.5Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayland before 24.1.15 a CVE-2026-1090978.2A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition file