CVE-2026-16443

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak (affected versions not specified)

Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider metadata is imported without specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses, regardless of whether a signing certificate is present. This allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account if the external identifier of the user is known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.