CVE-2026-16443

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

05/08/2026

Last modified:

10/08/2026

Description

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS v3.1 Severity and Metrics:

Base Score: 7.40 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): None

Base Score 3.x

7.40

Severity 3.x

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:redhat:build_of_keycloak::::::::	26.4 (including)	26.4.14 (excluding)
cpe:2.3:a:redhat:build_of_keycloak::::::::	26.6 (including)	26.6.5 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2026-16443

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools