Orta CVSS 4.3
CVE-2026-9798: Build Of Keycloak: güvenlik açığı
Açıklama (NVD)
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.
Özet bilgiler
- Ürün
- Redhat Build Of Keycloak
- CVSS v3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - EPSS
- %0,38 (yüzdelik 32)
- CWE
- CWE-305
- Yama
- Geçici çözüm
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-build-of-keycloak | — | — | — |