CVE-2026-16443
published 2026-08-05CVE-2026-16443: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build…
PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.32%
23.9th percentile
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk-keycloak-rhel9 | rhbk-keycloak-rhel9 | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-operator-bundle_26.4.14-1 | — | — |
| rhbk | keycloak-operator-bundle_26.6.5-1 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-22 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-11 | — | — |
| rhbk | keycloak-rhel9_26.4-22 | — | — |
| rhbk | keycloak-rhel9_26.6-11 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.
ghsa_unreviewed·2026-08-05
CVE-2026-16443 [HIGH] CWE-347 A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak.
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Red Hat
keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation
vendor_redhat·2026-08-05·CVSS 7.4
CVE-2026-16443 [HIGH] CWE-347 keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation
keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for unauthenticated account take
No detection rules found.
No public exploits indexed.
2026-08-05
Published