The vulnerability exists in the SAML metadata import process of the keycloak-services component in Red Hat build of Keycloak 26.4. When identity provider metadata does not specify usage attributes for keys, the system incorrectly disables signature validation for SAML responses despite the presence of a signing certificate. This improper verification of cryptographic signatures (CWE-347) enables an unauthenticated attacker to forge SAML responses and impersonate users by knowing their external identifiers, leading to unauthorized account access. Red Hat's advisory confirms the severity as important and notes the lack of a current mitigation or fix that satisfies ease of use, applicability, or stability requirements. The vulnerability has a CVSS v3.1 base score of 7.4, reflecting high confidentiality and integrity impact with no availability impact. No known exploits in the wild have been reported. Red Hat recommends monitoring their advisory for updates and notes that a security update (26.4.14) addressing multiple issues including this one is available, but the advisory does not explicitly confirm the fix status for this CVE in that update.

Successful exploitation allows an unauthenticated attacker to bypass signature validation of SAML responses, enabling them to forge authentication assertions and gain unauthorized access to user accounts by impersonating users. This compromises confidentiality and integrity of user authentication without requiring user interaction or privileges. There is no impact on availability. The vulnerability affects the core identity brokering engine in Red Hat build of Keycloak, potentially exposing affected deployments to account takeover attacks.

According to the Red Hat advisory, no mitigation currently meets the criteria for ease of use, applicability, or stability. Users should monitor Red Hat's official advisories for updates or patches addressing this vulnerability. The advisory mentions a security update for Red Hat build of Keycloak 26.4.14 that includes multiple fixes; users should verify if this update addresses CVE-2026-16443 and apply it accordingly. Until a fix is confirmed, consider restricting or reviewing SAML metadata imports to ensure usage attributes are properly specified or avoid importing metadata lacking these attributes if possible.