Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
Published Aug 5, 2026
9.1
CRITICALCVSS 3.1
EPSS 0.26%
Description
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Affected products
No data.
- ≥ 26.4 · < 26.4.14
- ≥ 26.6 · < 26.6.5
No data.
Red Hat build of Keycloak 26.4
rhbk/keycloak-operator-bundle:26.4.14-1
Fixed · RHSA-2026:50847
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9-operator:26.4-22
Fixed · RHSA-2026:50847
Red Hat build of Keycloak 26.4
rhbk/keycloak-rhel9:26.4-22
Fixed · RHSA-2026:50847
Red Hat build of Keycloak 26.4.14
keycloak-services
Fixed · RHSA-2026:50846
Red Hat build of Keycloak 26.4.14
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Fixed · RHSA-2026:50846
Red Hat build of Keycloak 26.6
rhbk/keycloak-operator-bundle:26.6.5-1
Fixed · RHSA-2026:50849
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9-operator:26.6-11
Fixed · RHSA-2026:50849
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9:26.6-11
Fixed · RHSA-2026:50849
Red Hat build of Keycloak 26.6.5
keycloak-services
Fixed · RHSA-2026:50848
Red Hat build of Keycloak 26.6.5
rhbk-keycloak-rhel9/rhbk-keycloak-rhel9
Fixed · RHSA-2026:50848
Red Hat build of Keycloak 26.6.5
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Fixed · RHSA-2026:50848
Red Hat Data Grid 8
keycloak-services
Not affected
Red Hat JBoss Enterprise Application Platform Expansion Pack
keycloak-services
Not affected
Red Hat Single Sign-On 7
keycloak-services
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-operator-bundle:26.4.14-1 | Fixed | RHSA-2026:50847 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9-operator:26.4-22 | Fixed | RHSA-2026:50847 |
| Red Hat build of Keycloak 26.4 | rhbk/keycloak-rhel9:26.4-22 | Fixed | RHSA-2026:50847 |
| Red Hat build of Keycloak 26.4.14 | keycloak-services | Fixed | RHSA-2026:50846 |
| Red Hat build of Keycloak 26.4.14 | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Fixed | RHSA-2026:50846 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle:26.6.5-1 | Fixed | RHSA-2026:50849 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9-operator:26.6-11 | Fixed | RHSA-2026:50849 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9:26.6-11 | Fixed | RHSA-2026:50849 |
| Red Hat build of Keycloak 26.6.5 | keycloak-services | Fixed | RHSA-2026:50848 |
| Red Hat build of Keycloak 26.6.5 | rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 | Fixed | RHSA-2026:50848 |
| Red Hat build of Keycloak 26.6.5 | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Fixed | RHSA-2026:50848 |
| Red Hat Data Grid 8 | keycloak-services | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-services | Not affected | n/a |
| Red Hat Single Sign-On 7 | keycloak-services | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Red Hat statement
The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for unauthenticated account takeover under common configuration scenarios. Successful exploitation allows an attacker to impersonate users and gain full access to their accounts by forging SAML responses. The vulnerability's root cause is an improper configuration of signature validation settings during the SAML IdP metadata import process.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1 other source (Red Hat) ▾
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Aug 5, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Aug–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.26% (0.00255) | 15.46th | v5 (v2026.06.15) |
| Aug 6, 2026 | 0.14% (0.00143) | 4.05th | v5 (v2026.06.15) |
References (8)
- https://access.redhat.com/errata/RHSA-2026:50846 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50847 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50848 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:50849 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-16443 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2503139 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16443
- https://www.cve.org/CVERecord?id=CVE-2026-16443
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:50846 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/errata/RHSA-2026:50847 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/errata/RHSA-2026:50848 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/errata/RHSA-2026:50849 | vendor-advisoryx_refsource_REDHATVendor Advisory | |
| https://access.redhat.com/security/cve/CVE-2026-16443 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2503139 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-16443 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-16443 |
Change history (0)
No recorded changes yet.