keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the...

CVE-2026-97174

A flaw in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak allows an attacker to perform a sub parameter injection . The CIBA endpoint fails to properly validate the sub parameter, enabling it to be stored as an additional request parameter. During token issuance,...