CVE-2026-16442: Keycloak SAML Auth Bypass Vulnerability

CVE-2026-16442 Overview

CVE-2026-16442 is an authentication bypass vulnerability in the SAML broker component of Keycloak, an open source identity and access management solution. The Identity Provider (IdP)-initiated Single Sign-On (SSO) endpoint fails to verify whether an upstream provider is restricted to account linking only. An attacker who controls a linked upstream identity can leverage this flaw to bypass login restrictions and gain full access to a local user account. The weakness is classified under CWE-346: Origin Validation Error and impacts identity federation deployments that rely on Keycloak brokering.

Critical Impact
Attackers controlling a federated upstream identity can hijack Keycloak local accounts, undermining identity federation trust boundaries and enabling downstream access to protected applications.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE Summary CVE-2026-16442)
Red Hat Single Sign-On distributions referenced in RHSA-2026:50846 and RHSA-2026:50847
Upstream Keycloak SAML broker component used for identity federation

Discovery Timeline

2026-08-05 - CVE-2026-16442 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16442

Vulnerability Analysis

Keycloak supports identity brokering through the SAML protocol, allowing a Keycloak realm to delegate authentication to an external SAML IdP. Administrators can configure a broker so that the upstream provider is used for Account Linking only, meaning the external identity may be linked to an existing local user but must not be treated as a valid login source on its own.

The vulnerability arises because the IdP-initiated SSO endpoint does not honor this restriction. When an unsolicited SAML assertion arrives at the broker endpoint, the code path skips the check that would normally reject authentication for account-linking-only providers. As a result, an assertion produced by the upstream IdP is accepted as a full authentication event for the linked local user.

Attackers who compromise or legitimately control an upstream identity that has been linked to a Keycloak account can issue an IdP-initiated SAML response and receive a valid Keycloak session. This subverts administrative intent, since account-linking-only providers are typically used for lower-trust identities such as social logins that were never meant to grant primary authentication.

Root Cause

The root cause is a missing authorization check on the IdP-initiated SSO endpoint. The endpoint validates the SAML assertion signature and mapping to a local user, but does not evaluate the broker's account linking only policy before establishing a session. This is a classic origin validation and business logic flaw tracked as CWE-346.

Attack Vector

Exploitation is remote and requires no privileges on the target Keycloak instance, but does require the attacker to control an upstream SAML identity that is already linked to a victim's local account. The attacker crafts a SAML Response and posts it to the Keycloak IdP-initiated SSO URL. Keycloak accepts the assertion, resolves the linked local user, and issues a session token for that user. The attacker then accesses any application federated through the affected realm as the victim.

No public exploit is currently listed in the enriched data, and the issue is not present on the CISA Known Exploited Vulnerabilities catalog. See the Red Hat Bug Report #2503138 for additional technical context.

Detection Methods for CVE-2026-16442

Indicators of Compromise

Successful Keycloak login events for local users where the authenticator is a SAML broker configured as account linking only.
Unsolicited SAML Response messages received at the IdP-initiated SSO endpoint from providers that were not expected to originate primary authentication.
Session creation events immediately following a broker callback, with no preceding user-driven login flow in the Keycloak event log.

Detection Strategies

Enable and forward the full Keycloak event stream, including IDENTITY_PROVIDER_LOGIN and IDENTITY_PROVIDER_FIRST_LOGIN, and correlate with broker configuration to flag logins from account-linking-only providers.
Review realm event logs for logins whose identity_provider attribute matches brokers with the linking-only flag set.
Alert on anomalous authentication paths where a user authenticates through a broker that has never previously issued primary logins for that account.

Monitoring Recommendations

Ingest Keycloak admin and login events into a centralized data lake and normalize identity fields for cross-source correlation.
Monitor federated login volume per broker and alert on statistically unusual spikes tied to linking-only providers.
Track SAML assertion issuers observed at the IdP-initiated endpoint and compare against an allow list of brokers intended to initiate SSO.

How to Mitigate CVE-2026-16442

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849 to affected Keycloak deployments.
Audit all configured SAML identity providers and identify those marked as account-linking only.
Review recent Keycloak event logs for suspicious IdP-initiated logins tied to linking-only brokers and invalidate active sessions where anomalies are found.
Rotate any high-value credentials or tokens issued to accounts that may have been accessed via the affected code path.

Patch Information

Red Hat has released fixed builds under advisories RHSA-2026:50846 through RHSA-2026:50849. Consult the Red Hat CVE Summary for CVE-2026-16442 for the definitive list of fixed package versions per product stream and apply the update matching your deployment channel.

Workarounds

Temporarily disable the IdP-initiated SSO option on SAML brokers configured for account linking only until patches are applied.
Unlink or disable upstream identities that are not required for active user workflows to reduce the exploitable surface.
Restrict network access to the Keycloak /broker/{provider}/endpoint path to trusted IdP source ranges where feasible.

bash

# Configuration example: disable a SAML broker pending patch (kcadm.sh)
# Replace REALM and BROKER_ALIAS with your environment values.
kcadm.sh update identity-provider/instances/BROKER_ALIAS \
  -r REALM \
  -s enabled=false