CVE-2026-16443 is a vulnerability in the keycloak-services component used by Red Hat Build of Keycloak for identity brokering. The flaw arises during the import of SAML identity provider metadata that lacks specific usage attributes for keys. In such cases, the system incorrectly disables signature validation for SAML responses despite the presence of a signing certificate. This improper verification of cryptographic signatures (CWE-347) enables an unauthenticated attacker to forge SAML responses and impersonate users by knowing their external identifiers, thereby gaining unauthorized access to user accounts. The vulnerability has a CVSS v3.1 base score of 7.4 (high severity) with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Red Hat has assessed the issue as important due to the potential for unauthenticated account takeover under common configurations. No patch or mitigation that meets Red Hat's standards for ease of use, applicability, or stability is currently available.

An unauthenticated attacker can forge SAML responses to impersonate users and gain full access to their accounts by exploiting the disabled signature validation. This leads to unauthorized account takeover and compromise of confidentiality and integrity of user data. There is no impact on availability. The vulnerability affects the core identity brokering engine in Red Hat Build of Keycloak, potentially impacting all deployments using vulnerable configurations.

Currently, there is no available patch or mitigation that meets Red Hat Product Security criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, consider restricting access to the affected service and carefully reviewing identity provider metadata configurations to avoid importing metadata lacking key usage attributes. Engage with Red Hat support or a Technical Account Manager for guidance.