RHSA-2026:50846Vendor advisory
https://access.redhat.com/errata/RHSA-2026:50846 CVE-2026-16443
HIGH
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
Record summary
CVE-2026-16443 has a selected CVSS score of 7.4 (high).
Description
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 14| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | Version data not supplied | |
Red Hat JBoss Enterprise Application Platform Expansion PackBrowse Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Packkeycloak-servicesDefault status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Red Hat build of Keycloak 26.4Browse Red Hat / Red Hat build of Keycloak 26.4rhbk/keycloak-operator-bundleDefault status: affected | CVE List | 26.4.14-1 to < * | unaffected |
Default status: affected | CVE List | 26.4-22 to < * | unaffected |
Red Hat build of Keycloak 26.4Browse Red Hat / Red Hat build of Keycloak 26.4rhbk/keycloak-rhel9-operatorDefault status: affected | CVE List | 26.4-22 to < * | unaffected |
Red Hat build of Keycloak 26.4.14Browse Red Hat / Red Hat build of Keycloak 26.4.14keycloak-servicesDefault status: unaffected | CVE List | Version data not supplied | |
Red Hat build of Keycloak 26.4.14Browse Red Hat / Red Hat build of Keycloak 26.4.14rhbk-openshift-rhel9/rhbk-openshift-rhel9Default status: unaffected | CVE List | Version data not supplied | |
Red Hat build of Keycloak 26.6Browse Red Hat / Red Hat build of Keycloak 26.6rhbk/keycloak-operator-bundleDefault status: affected | CVE List | 26.6.5-1 to < * | unaffected |
Default status: affected | CVE List | 26.6-11 to < * | unaffected |
Red Hat build of Keycloak 26.6Browse Red Hat / Red Hat build of Keycloak 26.6rhbk/keycloak-rhel9-operatorDefault status: affected | CVE List | 26.6-11 to < * | unaffected |
Default status: unaffected | CVE List | Version data not supplied | |
References
7RHSA-2026:50847Vendor advisory
https://access.redhat.com/errata/RHSA-2026:50847 RHSA-2026:50848Vendor advisory
https://access.redhat.com/errata/RHSA-2026:50848 RHSA-2026:50849Vendor advisory
https://access.redhat.com/errata/RHSA-2026:50849 access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-16443 RHBZ#2503139issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2503139 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-16443