CVE-2026-16443: Keycloak SAML Auth Bypass Vulnerability

CVE-2026-16443 Overview

CVE-2026-16443 is a signature validation bypass flaw in the SAML metadata import functionality of the keycloak-services component. This component powers identity brokering in Red Hat Build of Keycloak. When an administrator imports identity provider metadata that lacks specific KeyDescriptor use attributes, the system incorrectly disables signature validation for SAML responses even when a signing certificate is provided. An unauthenticated attacker who knows a victim's external identifier can forge a SAML response and impersonate that user. The weakness maps to CWE-347: Improper Verification of Cryptographic Signature.

Critical Impact
Attackers can forge SAML responses to gain unauthorized access to user accounts through identity brokering, compromising confidentiality and integrity of federated authentication.

Affected Products

Red Hat Build of Keycloak (keycloak-services component)
Red Hat single sign-on deployments relying on SAML identity brokering
Downstream applications federated through vulnerable Keycloak instances

Discovery Timeline

2026-08-05 - CVE-2026-16443 published to NVD
2026-08-05 - Last updated in NVD database
2026 - Red Hat issued security advisories RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849

Technical Details for CVE-2026-16443

Vulnerability Analysis

Keycloak supports SAML identity brokering, where an external identity provider (IdP) issues signed assertions that Keycloak validates before granting access. Metadata files describe the IdP's signing certificates using <KeyDescriptor> elements. The use attribute on these elements indicates whether a key is intended for signing or encryption.

When imported metadata omits the use attribute, the keycloak-services import logic fails to register the key as a signing key. As a result, signature validation is silently disabled for inbound SAML responses even though a certificate exists in the configuration. The broker then accepts unsigned or attacker-signed assertions as authentic.

See the Red Hat CVE-2026-16443 advisory and Red Hat Bugzilla #2503139 for the vendor's technical analysis.

Root Cause

The root cause is improper handling of optional SAML metadata attributes during import. The parser treats a missing KeyDescriptor use attribute as a signal to skip signature enforcement, rather than defaulting to strict validation. This violates the SAML 2.0 metadata specification, which treats keys without a use attribute as valid for both signing and encryption.

Attack Vector

An unauthenticated remote attacker crafts a SAML response containing the external identifier of a target user. The attacker submits this forged response to the Keycloak SAML endpoint associated with the misconfigured IdP. Because signature checks are disabled, Keycloak accepts the assertion and issues a session for the impersonated account. The attacker must know the victim's external identifier and the target realm, which raises attack complexity but does not require prior access.

No verified public exploit code is available. Refer to the Red Hat advisories for exploitation preconditions.

Detection Methods for CVE-2026-16443

Indicators of Compromise

SAML AuthnResponse messages accepted by Keycloak without a valid <ds:Signature> element on the assertion or response
IdP configurations where validateSignature is enabled but no signing key is populated after metadata import
Session creation events for federated users originating from unexpected IP addresses or user agents
Successful brokered logins immediately following an IdP metadata import or refresh

Detection Strategies

Audit all SAML IdP configurations for imported metadata missing KeyDescriptor use="signing" attributes
Correlate Keycloak LOGIN events with SAML message logs to identify assertions that bypassed signature validation
Alert on identity brokering logins where the same external identifier authenticates from geographically distant sources within a short window
Review Keycloak admin event logs for IDENTITY_PROVIDER_UPDATE actions preceding suspicious authentication activity

Monitoring Recommendations

Forward Keycloak server logs and admin event streams to a centralized SIEM for continuous review
Enable SAML request and response logging at the debug level in staging environments to validate signature enforcement post-patch
Track configuration drift on identityProvider entities using version-controlled infrastructure-as-code
Monitor authentication anomalies for accounts that authenticate exclusively through SAML federation

How to Mitigate CVE-2026-16443

Immediate Actions Required

Apply the Red Hat Build of Keycloak updates referenced in RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849
Re-import IdP metadata after patching to ensure signing keys are registered correctly
Review all federated identity provider definitions and confirm that signature validation is active
Rotate sessions and force re-authentication for federated users if compromise is suspected

Patch Information

Red Hat has released fixed packages through the four RHSA advisories listed above. Consult the Red Hat CVE-2026-16443 details page for the specific package versions applicable to your subscription and deployment channel.

Workarounds

Manually edit imported IdP metadata to add explicit use="signing" attributes on <KeyDescriptor> elements before import
Configure IdP entries directly through the Keycloak admin console rather than metadata import, ensuring signing certificates are attached explicitly
Restrict administrative access to IdP configuration endpoints to reduce the risk of malicious metadata upload
Disable affected SAML brokering flows until patches are applied

bash

# Verify a KeyDescriptor use attribute is present in IdP metadata before import
grep -E '<KeyDescriptor[^>]*use="signing"' /path/to/idp-metadata.xml || \
  echo "WARNING: signing KeyDescriptor use attribute missing - do not import"