A flaw in Keycloak allows an attacker who possesses valid client credentials to use the Client‑Initiated Backchannel Authentication (CIBA) flow to bypass the temporary lock that normally prevents logins after repeated failed attempts. This exploitation enables continued authentication attempts and token issuance even while an account is marked as locked, thereby undermining the security controls designed to thwart brute‑force attacks. The weakness maps to CWE‑305, reflecting an excessive or improper permission granted to an attacker through credential misuse.

The vulnerability affects Red Hat Build of Keycloak. No specific version information is provided, so all deployments of this product are potentially susceptible until a patch is applied.

The CVSS score of 4.3 indicates a moderate risk level, and the EPSS score is not available, suggesting limited publicly known exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to have legitimate client credentials and the ability to invoke CIBA. Once these conditions are met, the attacker can repeatedly attempt logins or obtain tokens against a locked account, which could lead to further unauthorized access attempts.