by Kastro CVE-2026-16442
Red Hat Red Hat build of Keycloak 26.4 — Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
Description · from the CVE record
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Affected
ProductAffectedFixed inSource
Red Hat build of Keycloak 26.4see advisory26.4.14-1CNA
Red Hat build of Keycloak 26.4see advisory26.4-22CNA
Red Hat build of Keycloak 26.4see advisory26.4-22CNA
Red Hat build of Keycloak 26.4.14see advisory–CNA
Red Hat build of Keycloak 26.4.14see advisory–CNA
Red Hat build of Keycloak 26.6see advisory26.6.5-1CNA
Red Hat build of Keycloak 26.6see advisory26.6-11CNA
Red Hat build of Keycloak 26.6see advisory26.6-11CNA
Red Hat build of Keycloak 26.6.5see advisory–CNA
Red Hat build of Keycloak 26.6.5see advisory–CNA
Red Hat build of Keycloak 26.6.5see advisory–CNA
Red Hat Data Grid 8see advisory–CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial