CVE-2026-16093

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Client Policies mechanism, which is designed to enforce security requirements on clients, such as the mandatory use of signed JSON Web Tokens (JWTs) for authentication. An attacker possessing valid client credentials can bypass this enforcement by providing a fake, unsigned assertion header. This trick leads the system to believe that policy requirements have been satisfied, allowing the attacker to authenticate using less secure methods, such as a client secret, despite administrative mandates for signed assertions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.