Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T13:39:33 keycloak-services: keycloak-services: SAML broker metadata import disables response signature validation 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-347

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for unauthenticated account takeover under common configuration scenarios. Successful exploitation allows an attacker to impersonate users and gain full access to their accounts by forging SAML responses. The vulnerability's root cause is an improper configuration of signature validation settings during the SAML IdP metadata import process. Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-operator-bundle:26.4.14-1 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9:26.4-22 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9-operator:26.4-22 Red Hat build of Keycloak 26.4.14 2026-08-05T00:00:00Z RHSA-2026:50846 keycloak-services Red Hat build of Keycloak 26.4.14 2026-08-05T00:00:00Z RHSA-2026:50846 rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-operator-bundle:26.6.5-1 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9:26.6-11 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9-operator:26.6-11 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 keycloak-services Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-16443 https://nvd.nist.gov/vuln/detail/CVE-2026-16443