CVE-2026-16443: Improper Verification of Cryptographic Signature in Red Hat Red Hat build of Keycloak 26.4
CVE-2026-16443 is a vulnerability in the SAML metadata import functionality of the keycloak-services component in Red Hat build of Keycloak. The flaw causes signature validation for SAML responses to be incorrectly disabled when importing identity provider metadata lacking specific usage attributes, even if a signing certificate is present. This allows an unauthenticated attacker to forge SAML responses and gain unauthorized access to user accounts by knowing their external identifiers. Red Hat has rated this vulnerability as Important (high severity). A security update is available in Red Hat build of Keycloak version 26.4.14 to address this issue.
AI Analysis
Technical Summary
The vulnerability exists in the SAML metadata import process of the keycloak-services component in Red Hat build of Keycloak. When identity provider metadata lacks certain usage attributes for keys, the system disables signature validation for SAML responses despite the presence of a signing certificate. This improper verification of cryptographic signatures (CWE-347) enables unauthenticated attackers to forge SAML responses and impersonate users by knowing their external identifiers. The vulnerability affects versions >=26.4.0 <26.4.14 and >=26.6.0 <26.6.5. Red Hat has released version 26.4.14 containing the fix. The CVSS v3.1 score is 7.4 (high severity) with network attack vector, high attack complexity, no privileges required, and no user interaction.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass signature validation on SAML responses, enabling them to forge responses and gain unauthorized access to user accounts. This results in full account takeover and impersonation of users. The vulnerability compromises confidentiality and integrity but does not affect availability.
Mitigation Recommendations
Red Hat has released an official security update in Red Hat build of Keycloak version 26.4.14 that fixes this vulnerability. Users should upgrade affected installations to version 26.4.14 or later to remediate the issue. No effective mitigation other than applying the update is currently available or meets Red Hat's criteria for ease of use and applicability. Users are advised to back up their installations before applying the update.
CVE-2026-16443: Improper Verification of Cryptographic Signature in Red Hat Red Hat build of Keycloak 26.4
Description
CVE-2026-16443 is a vulnerability in the SAML metadata import functionality of the keycloak-services component in Red Hat build of Keycloak. The flaw causes signature validation for SAML responses to be incorrectly disabled when importing identity provider metadata lacking specific usage attributes, even if a signing certificate is present. This allows an unauthenticated attacker to forge SAML responses and gain unauthorized access to user accounts by knowing their external identifiers. Red Hat has rated this vulnerability as Important (high severity). A security update is available in Red Hat build of Keycloak version 26.4.14 to address this issue.
CVSS v3.1
Score 7.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the SAML metadata import process of the keycloak-services component in Red Hat build of Keycloak. When identity provider metadata lacks certain usage attributes for keys, the system disables signature validation for SAML responses despite the presence of a signing certificate. This improper verification of cryptographic signatures (CWE-347) enables unauthenticated attackers to forge SAML responses and impersonate users by knowing their external identifiers. The vulnerability affects versions >=26.4.0 <26.4.14 and >=26.6.0 <26.6.5. Red Hat has released version 26.4.14 containing the fix. The CVSS v3.1 score is 7.4 (high severity) with network attack vector, high attack complexity, no privileges required, and no user interaction.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass signature validation on SAML responses, enabling them to forge responses and gain unauthorized access to user accounts. This results in full account takeover and impersonation of users. The vulnerability compromises confidentiality and integrity but does not affect availability.
Mitigation Recommendations
Red Hat has released an official security update in Red Hat build of Keycloak version 26.4.14 that fixes this vulnerability. Users should upgrade affected installations to version 26.4.14 or later to remediate the issue. No effective mitigation other than applying the update is currently available or meets Red Hat's criteria for ease of use and applicability. Users are advised to back up their installations before applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v5j7-jp89-37vr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16443"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a738521bf8831d5394efa5e
Added to database: 08/05/2026, 18:46:57 UTC
Last enriched: 09/12/2026, 07:01:45 UTC
Last updated: 09/18/2026, 22:01:32 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.