CVE-2026-109082

Executive Summary

CVE-2026-109082 is an improper authentication flaw (CWE-287) in the Client-Initiated Backchannel Authentication (CIBA) implementation of the keycloak-services component in Keycloak. Keycloak fails to verify that a requesting client is actually authorized to use the CIBA flow, allowing public clients—which by definition hold no client secret—to initiate authentication requests that should be restricted to confidential clients. Successful exploitation requires user interaction (the victim must approve a backchannel login request), but yields high confidentiality and integrity impact, enabling an attacker to obtain full access to the victim's account without possessing a client secret.

Technical Analysis

CIBA (Client-Initiated Backchannel Authentication) is an OpenID Connect extension designed for decoupled authentication flows—for example, a call-center agent or a point-of-sale terminal initiating a login that the end user approves out-of-band on a separate device (push notification, authenticator app, or similar). The security model of CIBA depends on strict authorization of the initiating client: only clients that have been explicitly permitted to consume the CIBA flow should be able to create authentication requests on behalf of a user.

According to the NVD description, the vulnerability resides in the CIBA implementation within the keycloak-services component. Specifically, "Keycloak fails to verify that a client is authorized to use the CIBA flow." This is a missing-authorization-check defect (CWE-287, Improper Authentication). The consequence is that public clients—OAuth 2.0 clients that cannot keep a secret because they run in untrusted environments such as browsers or mobile apps—can invoke the CIBA flow that should only be available to confidential clients bound to this capability.

The attack mechanism is a class-level authentication-bypass: because the authorization gate on the CIBA initiation endpoint is absent or insufficient, a client that lacks any legitimate entitlement to CIBA (and lacks a client secret) is nonetheless treated as a valid initiator. From that position, the attacker issues a backchannel authentication request naming a target user. The legitimate user receives the approval prompt generated by the normal CIBA out-of-band channel and—if socially engineered or confused about why they are being asked—approves it. Because the approval is genuine from the IdP's perspective, the attacker's client receives tokens for the victim's account.

No further code-level detail (specific function names, endpoint paths, parameter names, or configuration keys) is provided in the NVD description or CNA title, so this report deliberately does not invent them. The vulnerability class is a server-side authorization/entitlement check that is missing for a specific authentication flow.

Contributing factors consistent with the description:

• CIBA requires the server to distinguish between clients permitted to initiate backchannel authentication and clients that are merely registered.
• Public clients have no shared secret, so any security property of the CIBA flow that is assumed to rest on client authentication collapses when public clients are admitted to the flow.
• The approval step shifts the burden of the security decision onto the end user, who has no reliable way to distinguish a legitimate business-triggered request from an attacker-triggered one.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class and the NVD description. No public PoC exists (POC_STATUS: None); the chain is an inferred model, not a reproduced exploit.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment that has the CIBA authentication flow enabled and exposed to the network (CVSS AV:N, PR:N — no privileges or prior credentials required). The attacker registers or already controls a public client (no client secret). Because the server fails to validate CIBA entitlement for the client, the attacker does not need to obtain a client secret or be granted CIBA permission.

2. Triggering the flaw class. The attacker, acting as the public client, initiates a CIBA authentication request directed at a chosen victim account. The precise endpoint and parameter set are not enumerated in the available data; at the vulnerability-class level, this is a backchannel authentication initiation that the server should have rejected because the requesting client is not authorized for CIBA. The missing authorization check is the exploitable condition.

3. User approval / execution. The CIBA protocol delivers an out-of-band approval request to the victim (for example, a push notification or authenticator prompt). This is why the CVSS vector includes UI:R — user interaction is required. The attacker relies on social engineering, notification fatigue, or simple user confusion ("approve this login to continue") to induce the victim to approve. There is no payload in the traditional sense; the "payload" is the approved authentication transaction itself.

4. Post-exploitation impact. Once the victim approves, the attacker's public client receives tokens for the victim's account. Per the CVSS vector, confidentiality and integrity impacts are High (C:H/I:H) and availability impact is None (A:N). With valid session/access tokens, the attacker gains "full access to the user's account"—reading data, acting as the user, and accessing any application or downstream resource federated through Keycloak, all without ever holding a client secret. Because the resulting access uses legitimate tokens, activity blends into normal authentication telemetry.

Note: AC:H reflects that the attack is not trivially automatable—it depends on the victim approving a request—but the condition is reliably reachable at scale through social engineering campaigns.

Impact Assessment

• Confidentiality: High. The attacker obtains tokens granting the victim's account context, exposing data and resources the victim can reach.
• Integrity: High. The attacker can perform actions as the victim within every application relying on Keycloak for authentication and authorization.
• Availability: None. The flaw does not directly degrade service availability.
• Scope: Unchanged. The impact is confined to the Keycloak identity plane and the resources it brokers.

Affected systems. Any Keycloak deployment with the CIBA flow enabled and reachable by untrusted clients. Identity providers are high-value, centralized chokepoints: a single compromised account can cascade into every application integrated with that realm (single sign-on blast radius). Environments where CIBA is used for customer-facing or workforce decoupled authentication (call centers, branch banking, POS/agent workflows, passwordless push approvals) are most exposed.

Severity rationale. CVSS 6.8 (Medium) understates the practical risk in SSO-centric environments: successful exploitation yields complete account takeover of the targeted user, and the attack requires no secret and no prior access (PR:N). The AC:H/UI:R components are the only elements holding the score below High; both are mitigable by an attacker through social engineering. The vulnerability is unpatched per tracked sources (Patch Confidence 0/4), meaning every deployment exposing CIBA remains exposed until the missing authorization check is remediated.

Detection Guidance

Sigma Rule

title: Potential Keycloak CIBA Unauthorized Client Initiation
id: 8f2c1a44-7b9e-4d3a-9c11-keycloakciba01
status: experimental
description: Detects CIBA (backchannel authentication) initiation attempts from public or unauthorized clients in Keycloak, consistent with CVE-2026-109082.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109082
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  product: keycloak
  service: server
detection:
  selection:
    event_type: 'CIBA_AUTH_REQUEST'
  filter_legit:
    client_type: 'CONFIDENTIAL'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate CIBA clients misconfigured as public clients
level: high
tags:
  - attack.t1078
  - cve.2026.109082

YARA Rule

rule CVE_2026_109082_Keycloak_CIBA_PublicClient
{
    meta:
        description = "Detects Keycloak CIBA-related artifacts indicating public-client backchannel initiation (CVE-2026-109082)"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109082"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $ciba1 = "backchannel_authentication" ascii nocase
        $ciba2 = "client-initiated-backchannel" ascii nocase
        $ciba3 = "CIBA" ascii
        $pub1  = "\"publicClient\":true" ascii nocase
        $pub2  = "publicClient" ascii nocase
    condition:
        uint16(0) == 0x4B50 or
        ( 2 of ($ciba*) and 1 of ($pub*) ) or
        ( $ciba1 and $ciba2 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109082 Keycloak CIBA Backchannel Authentication Initiation Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"backchannel"; nocase; http.uri; content:"auth"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-109082; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109082; sid:2026109082; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      url.path contains "backchannel" and
      url.path contains "auth" and
      network.protocol == "http" ]
  [ authentication where event.outcome == "success" and
      user.name : * ]

Splunk SPL Query

index=keycloak sourcetype=keycloak_logs
( "backchannel" OR "CIBA" OR "ciba" )
| eval is_public=if(match(_raw, "(?i)public[ _-]?client"), "yes", "no")
| stats count values(client_id) as clients values(user) as users by src_ip, is_public
| where is_public="yes" AND count > 0
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,authentication,cve-2026-109082,">
  <rule id="109082" level="12">
    <decoded_as>json</decoded_as>
    <field name="logger">org.keycloak</field>
    <match>backchannel|CIBA|client-initiated-backchannel</match>
    <description>CVE-2026-109082: Possible unauthorized Keycloak CIBA backchannel authentication attempt (public client)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Disable the CIBA flow in Keycloak realms where it is not strictly required. If CIBA is unused, removing the authentication flow eliminates the attack surface entirely.
   • Restrict CIBA to confidential clients. Ensure that no public client is granted the CIBA capability; where the server-side check is absent, enforce this administratively by auditing client registrations and revoking CIBA permissions from public clients.
   • Network-restrict backchannel endpoints to trusted initiator networks (call-center, internal agent subnets) via reverse proxy or firewall ACLs, since exploitation requires reachability (AV:N).
   • Harden the user-approval channel. Educate users to reject unexpected login-approval prompts, and where the CIBA provider supports it, require context binding (application name, origin, IP) in the approval notification so users can distinguish legitimate requests.
   • Monitor and rate-limit CIBA initiation attempts per client and per source IP; alert on public-client initiations as high-severity identity events.

2. Patch / upgrade steps.

   • No vendor fix is available per current tracked sources (Patch Sources: []). Monitor Keycloak security advisories and the project's release notes for a fix that restores the client-authorization check in the CIBA flow, then upgrade immediately upon release.
   • Treat any Keycloak release that revises CIBA authorization logic as the remediation milestone; validate in a staging realm that public clients are rejected from backchannel initiation after upgrade.

3. Long-term hardening.

   • Enforce least-privilege client registration: default-deny CIBA capability, granted only to explicitly approved confidential clients.
   • Adopt continuous configuration auditing to detect public clients with elevated flow entitlements.
   • Implement phishing-resistant and notification-fatigue-resistant user approval (number matching, context binding) across all decoupled authentication flows.
   • Maintain an inventory of Keycloak realms and flows, with CIBA tracked as a high-risk capability.

References

• NVD — CVE-2026-109082: https://nvd.nist.gov/vuln/detail/CVE-2026-109082
• Keycloak project security advisories: https://www.keycloak.org/security
• OpenID Connect Client-Initiated Backchannel Authentication (CIBA) specification: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• CISA KEV catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence is available for CVE-2026-109082 at the time of writing. No public PoC or exploit code was identified; EPSS has not yet been scored by FIRST.org, and the vulnerability is not listed in CISA KEV.