CVE-2026-16442 is a security flaw in the SAML broker component of Red Hat Build of Keycloak. The vulnerability arises from the IdP-initiated Single Sign-On endpoint failing to verify whether a provider is restricted to account linking only. This flaw enables an attacker who controls a linked upstream identity to bypass login restrictions and obtain full authenticated access to the corresponding local user account. The root cause is the lack of enforcement of the link-only configuration within the SAML IdP-initiated SSO endpoint. Red Hat has assessed the severity as Important (high) due to the potential for authentication bypass and privilege escalation. No patch or effective mitigation is currently available according to Red Hat's advisory.

Successful exploitation allows an unauthenticated attacker with control over a linked upstream identity to bypass login restrictions and gain full authenticated access to a local user account. This compromises confidentiality and integrity of the affected account but does not impact availability. The vulnerability enables privilege escalation by circumventing administrative restrictions on account linking.

Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates on fixes. Until a fix is available, no official mitigation is recommended by Red Hat.