Analyst readout for executives and security teams
Plain-English summary
This flaw weakens Keycloak account lockout controls. Even after repeated failed logins temporarily lock a user account, a client using the CIBA flow may keep attempting authentication and may receive tokens. That reduces the business value of brute-force protection for affected Keycloak deployments.
Executive priority
Treat as a targeted identity-control weakness, not an internet-scale emergency. Prioritize assessment where Keycloak protects sensitive applications, CIBA is enabled, or account lockout is a key compensating control.
Technical view
CVE-2026-9798 is a CWE-305 authentication bypass issue in Red Hat Build of Keycloak. The source states that CIBA can bypass temporary brute-force account lockout when an attacker has valid client credentials. CVSS is 4.3, network exploitable, low complexity, user interaction required, with limited confidentiality impact.
Likely exposure
Exposure is most likely in Red Hat Build of Keycloak deployments using CIBA-capable clients and brute-force lockout policies. The bundle lists rhbk/keycloak-rhel9 as affected, but does not provide exact affected versions.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. Abuse is constrained by the stated need for valid client credentials and the CIBA flow, but it can undermine account lockout assumptions.
Researcher notes
The bundle does not include fixed versions, patches, or detailed reproduction material. Avoid assuming upstream Keycloak versions beyond Red Hat Build of Keycloak unless vendor sources confirm them. Key validation questions are CIBA enablement, client credential exposure, and token issuance during lockout.
Mitigation direction
- Check Red Hat advisory and Bugzilla for fixed builds or official mitigations.
- Inventory Red Hat Build of Keycloak deployments and identify CIBA usage.
- Prioritize systems where CIBA clients protect sensitive users or high-value applications.
- Review client credentials and remove unused or overprivileged CIBA-capable clients.
- Increase monitoring for authentication attempts against temporarily locked accounts.
Validation and detection
- Confirm whether deployed Keycloak builds match Red Hat affected product guidance.
- Identify clients configured for Client-Initiated Backchannel Authentication.
- Review brute-force protection settings and recent temporary lockout events.
- Correlate token issuance activity with accounts that should be locked.
- Document unknown version exposure where vendor fixed-version data is unavailable.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-305: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-9798 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N 2.8 1.4 redhat Vulnerability scoring details
Base CVSS 3.1 score
4.3 MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline redhat
Reported to Red Hat.
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline redhat
Made public.
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- https://access.redhat.com/security/cve/CVE-2026-9798 CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2482470 CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Primary Weakness
Authentication Bypass by Primary Weakness represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.