The vulnerability in Keycloak’s CIBA endpoint allows an attacker to inject a malicious sub parameter, which is treated as an additional request field. This injected value replaces the legitimate subject identifier during token issuance. The result is that an attacker authenticating as themselves can receive security tokens that belong to another user, enabling unauthorized access to that user's account.

Red Hat’s Build of Keycloak and Red Hat Single Sign‑On 7 are affected. The data does not specify particular versions, so the flaw applies to all installations of these products that contain the issue.

The CVSS score is 6.8, indicating moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a request to the CIBA endpoint that includes an injected sub parameter; if the endpoint is reachable, the attacker can receive tokens for arbitrary users.