---
id: "CVE-2026-97174"
kind: "vulnerability"
aliases: ["CVE-2026-97174"]
title: "Keycloak: CIBA sub parameter injection lets attackers receive victim tokens"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authentication", "identity", "keycloak", "package", "self-hosted"]
not_affected_if: ["ciba-disabled", "managed-hosting"]
published_at: "2026-11-05T18:17:11+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:40:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97174", "first_seen_at": "2026-11-05T18:40:10+00:00"}]
exploit_sources: []
---

# Keycloak: CIBA sub parameter injection lets attackers receive victim tokens

Keycloak's Client-Initiated Backchannel Authentication (CIBA) endpoint does not validate the sub parameter, so it can be stored as an extra request parameter. During token issuance that value overwrites the real subject, so an attacker who signs in as themselves can receive security tokens for another user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Keycloak version in use, for example with `kc.sh --version` or the server banner in logs; compare it against the fixed versions below.
- Check whether CIBA is enabled for any client in the realm (Clients > client > Advanced settings, or the CIBA policy settings), since the flaw is in the CIBA implementation.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97174

## From the sources

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During the token issuance process, this injected value overwrites the legitimate subject identifier. This allows an attacker to authenticate as themselves but receive security tokens belonging to a different victim user, leading to unauthorized account access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_