CVE-2026-16443: Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Other sources
A vulnerability was identified in Keycloak where the SAML Identity Provider IdP metadata parser incorrectly configures signature validation. When a metadata document is imported that sets WantAuthnRequestsSigned to false and includes a KeyDescriptor without an explicit use attribute, the parser stores the certificate but fails to enable the validateSignature setting. As a result, the broker endpoint /realms/realm/broker/alias/endpoint does not verify the cryptographic signature of incoming SAML responses. An unauthenticated remote attacker can exploit this by capturing a valid RelayState and SAML request ID through a standard login flow and then submitting a forged, unsigned SAML response. By providing the external SAML NameID of a target user, the attacker can successfully authenticate as that user. Successful exploitation allows an attacker to: Bypass authentication mechanisms.
Impersonate any user who has a federated identity link.
Access and modify data belonging to the compromised user account.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure signature validation is enabled for incoming SAML responses; do not import SAML IdP metadata that disables validation (e.g., metadata that sets WantAuthnRequestsSigned to false) and handle KeyDescriptor elements so that the validateSignature setting is not left disabled when a signing certificate is provided.
Keycloak (keycloak-services SAML broker metadata import) validateSignature = enabled - Compensating control
For the broker endpoint (/realms/realm/broker/alias/endpoint), ensure only trusted callers can submit SAML responses (e.g., restrict access to this endpoint via network controls/ACLs/WAF) to reduce exposure to unauthenticated remote exploitation that forges unsigned SAML responses using a captured RelayState and SAML request ID.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16443?
The severity of CVE-2026-16443 is critical with a score of 9.1.
What does CVE-2026-16443 affect?
CVE-2026-16443 affects the keycloak-services component of Red Hat Build of Keycloak.
How do I fix CVE-2026-16443?
To fix CVE-2026-16443, ensure that proper usage attributes for keys are included when importing SAML metadata.
What is the impact of CVE-2026-16443?
CVE-2026-16443 can lead to the disabling of response signature validation during SAML metadata import.
When was CVE-2026-16443 published?
CVE-2026-16443 was published on July 21, 2026.