CVE-2026-16442: Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Other sources
A vulnerability was found in the keycloak-services component where the SAML IdP-initiated broker login endpoint fails to enforce the link-only identity provider restriction. When a SAML identity provider is configured with linkOnly=true, it is intended to only allow users to link their accounts, not to use that provider for logging in. However, the endpoint at /realms/{realm}/broker/{alias}/endpoint/clients/{clientid} does not validate this setting. An attacker who controls an upstream SAML identity already linked to a Keycloak user can submit a valid signed SAML response directly to this endpoint. This allows the attacker to bypass the restriction and obtain a full authenticated session as the linked local user.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16442?
CVE-2026-16442 has a severity rating of high, with a score of 7.4.
How do I fix CVE-2026-16442?
To mitigate CVE-2026-16442, ensure that the SAML IDP-initiated Single Sign-On endpoint is properly configured to enforce link-only restrictions.
What systems are affected by CVE-2026-16442?
CVE-2026-16442 affects the Keycloak services that handle identity federation and user authentication.
What type of vulnerability is CVE-2026-16442?
CVE-2026-16442 is a security vulnerability related to single sign-on mechanisms that bypass account linking restrictions.
What impact does CVE-2026-16442 have on security?
CVE-2026-16442 allows attackers to bypass link-only restrictions, potentially compromising user accounts.