CVE-2026-16443: Signature Validation Bypass in Keycloak SAML Metadata Import

CVE-2026-16443 describes a critical security flaw in the SAML metadata import functionality within the keycloak-services component of Red Hat Build of Keycloak. The vulnerability arises when an administrator or automated process imports identity provider metadata that lacks specific usage attributes for keys. Under these conditions, the Keycloak engine incorrectly disables signature validation for subsequent SAML responses, even if a valid signing certificate is present in the metadata. This oversight creates an authentication bypass scenario, as the application fails to verify the integrity and origin of incoming SAML tokens. An unauthenticated attacker, knowing a target user's external identifier, can forge a SAML response, masquerade as a legitimate user, and gain unauthorized access to the affected environment. The flaw poses a significant risk to organizations relying on Keycloak for identity brokering and single sign-on services, as it fundamentally compromises the trust relationship between the service provider and the identity provider.

Impact

Successful exploitation of this vulnerability allows unauthorized access to user accounts within applications protected by Keycloak. In enterprise environments, this may lead to full account takeover, unauthorized access to sensitive corporate resources, and potential data exfiltration. The vulnerability impacts all deployments of Red Hat Build of Keycloak utilizing SAML identity brokering features that rely on metadata imports.

Recommendation

Prioritized actions for detection and remediation:

• Update Red Hat Build of Keycloak to the latest patched version provided by Red Hat to resolve CVE-2026-16443.
• Audit all configured SAML identity providers in the Keycloak admin console to ensure "Signature Validation" is explicitly enabled and not reliant on default or metadata-derived settings.
• Review SAML authentication logs for suspicious successful login events where the assertion signature could not be verified or where assertions originated from unexpected identity provider endpoints.