CVE-2026-16103

mediumpriority · track · 0EPSS 0.003 · 28 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (28th) EPSS

CVSS 4.3 · medium

Is it mine?

2 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · secalert@redhat.com USexploitability 2.8 · impact 1.4

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-305USprimaryCWE-841US

affected products (2)

Products and version ranges known to be affected.

Open Source Keycloakall versionscert_bundDEcpe:/a:keycloak:keycloak:-
redhat build of keycloakall versionsnvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2407Keycloak: Mehrere SchwachstellenDeutsch2026-07-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2026-07-17modified 2026-08-31

related (221)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-81578US	critical9.8OT critical	83.7% (100th)	KEV	2026-08-28
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting…
CVE-2025-31161US	critical9.8OT critical	100.0% (100th)	KEV	2025-04-03
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild i…
CVE-2024-37085US	high7.2OT critical	26.8% (98th)	KEV	2024-06-25
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previ…
CVE-2020-10923US	high8.8	84.7% (100th)	Exploit	2020-07-28
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required t…
CVE-2023-34124US	critical9.8	50.5% (99th)	Exploit	2023-07-13
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier vers…

+216 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan