CVE-2026-16442

criticalpriority · track · 39EPSS 0.003 · 23 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.31% (23rd) EPSS

CVSS 9.8 · critical

Is it mine?

16 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-23

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.4–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 2.2 · impact 5.2

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-346US

affected products (16)

Products and version ranges known to be affected.

Open Source Keycloak Red Hat build of Keycloa <26.4-22all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.4.14-1all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6-11all versionscert_bundDE
Open Source Keycloak Red Hat build of Keycloa <26.6.5-1all versionscert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6.5-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4-22cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.4.14-1cert_bundDE
Open Source Keycloak≤ Red Hat build of Keycloa <26.6-11cert_bundDE
Red Hat Red Hat build of Keycloak 26.4< 26.4-22enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4.14-1enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6-11enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.6< 26.6.5-1enisa_euvdEU
redhat build of keycloak26.4 → 26.4.14nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat build of keycloak26.6 → 26.6.5nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
Bitnami keycloak26.4.0 → 26.4.14osvUSpkg:bitnami/keycloak
Bitnami keycloak26.6.0 → 26.6.5osvUSpkg:bitnami/keycloak

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2677RedHat Build of Keycloak: Mehrere SchwachstellenDeutsch2026-08-05csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Administratorrechte zu erlangen, Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.
BIT-keycloak-2026-16442Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction2026-08-25vendor · osvUS
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2026-08-05modified 2026-08-10

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan