CVE-2026-16442 Red Hat CVE debrief

Who should care

Administrators and security teams managing Keycloak configurations, especially those using the SAML broker component for identity federation and user authentication, should be aware of this vulnerability and take necessary actions to mitigate potential risks. This includes verifying configurations, applying patches, and monitoring for suspicious activity related to Single Sign-On endpoints.

Technical summary

The CVE-2026-16442 vulnerability is related to the SAML broker component of Keycloak. The issue arises from the IdP-initiated Single Sign-On endpoint not checking if a provider is restricted to account linking only. This oversight allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account. The vulnerability has a CVSS score of 7.4 and is classified as HIGH severity. Keycloak administrators should verify their configurations and ensure that all necessary patches are applied to prevent potential exploitation.

Defensive priority

Organizations using Keycloak should verify their configurations and ensure that all necessary patches are applied to prevent potential exploitation.

Recommended defensive actions

• Verify Keycloak configurations to ensure that the SAML broker component is properly restricted.
• Apply patches from Red Hat to address the vulnerability.
• Monitor for suspicious activity related to Single Sign-On endpoints.
• Review and update identity federation and user authentication settings.
• Perform a thorough review of the Keycloak deployment to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-16442 record indicates a flaw in Keycloak's SAML broker component, which could allow an attacker to bypass login restrictions. Evidence is based on official CVE and NVD records, as well as references from Red Hat's security advisories. The issue arises from the IdP-initiated Single Sign-On endpoint not checking if a provider is restricted to account linking only. This oversight allows an attacker with control over a linked upstream identity to gain full access to a local user account. Keycloak administrators should verify their configurations and ensure that all necessary patches are applied to prevent potential exploitation.

Official resources