Medium 6.8

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of...

CVE-2026-97174 First seen on SecPulse Nov 6, 02:15

Original description The description as published by the source.

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.8; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Published: Nov 6, 2026
First seen on SecPulse: Nov 6, 02:15
GHSA: GHSA-42wm-mqj8-5cwr
CWE: CWE-20

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-20

Vendors

Red Hat

All

Red Hat Build Of Keycloak Red Hat Single Sign On 7 Red Hat Build Of Keycloak 2668 Red Hat Build Of Keycloak 266

Operating Systems

RHEL

Detection sources

NIST National Vulnerability DatabaseNov 7, 02:20
GitHub Security Advisories (Global)Nov 7, 03:35
Red Hat Security AdvisoriesNov 6, 10:05
CVE.org (CVE Program・cvelistV5)Nov 7, 02:12