A flaw in Keycloak’s Client‑Initiated Backchannel Authentication (CIBA) flow allows public clients to bypass authorization checks, enabling an attacker to trick a user into approving a login request without a client secret. The vulnerability arises from an authentication failure (CWE-287) where the system does not verify that a client is permitted to use the CIBA flow, potentially leading to full access to the victim’s account.

The issue impacts Red Hat’s Build of Keycloak and Red Hat Single Sign‑On 7. No specific version information is provided, so any deployment of these products that includes the keycloak-services component is potentially affected.

The CVSS score of 6.8 classifies the flaw as moderately severe. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this weakness remotely by acting as a public client; they need only to trigger the CIBA flow, entice a user to approve the request, and then obtain authentication tokens for the user’s account.