CVE-2026-16442
published 2026-08-05CVE-2026-16442: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.31%
23.1th percentile
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk-keycloak-rhel9 | rhbk-keycloak-rhel9 | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-operator-bundle_26.4.14-1 | — | — |
| rhbk | keycloak-operator-bundle_26.6.5-1 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-22 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-11 | — | — |
| rhbk | keycloak-rhel9_26.4-22 | — | — |
| rhbk | keycloak-rhel9_26.6-11 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction
vendor_redhat·2026-08-05·CVSS 7.4
CVE-2026-16442 [HIGH] CWE-346 keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction
keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for an authentication bypass. Successful exploitation allows an attacker to obtain a full authenticated session as a linked local user, bypassing administrative r
GHSA
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.
ghsa_unreviewed·2026-08-05
CVE-2026-16442 [HIGH] CWE-346 A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication.
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
No detection rules found.
No public exploits indexed.
2026-08-05
Published