CVE-2026-16442

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the SAML broker component used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to verify if a provider is restricted to account linking only. This allows an attacker who controls a linked upstream identity to bypass login restrictions and obtain full access to a local user account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.