CVE-2026-16442

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

View on CVE.org
Published Aug 5, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Description
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

Analysis

AI-generated

Technical impact

A flaw was discovered in the SAML broker component used by Keycloak to handle identity federation. The IdP‑initiated Single Sign‑On endpoint does not verify whether a provider is configured for link‑only operations. This omission allows an attacker who controls a linked upstream identity to skip the normal login check and acquire full access to the local user account, effectively bypassing authentication. As a consequence the attacker can gain unauthorized access to protected resources and data belonging to that account.

Affected Systems

The vulnerability affects Red Hat Build of Keycloak, the Red Hat Data Grid 8 offering, the JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Exact impacted versions are not listed in the advisory, so any deployment of these products that includes the SAML broker component is potentially vulnerable.

Risk and Exploitability

The CVSS score of 7.4 indicates a high severity, while the EPSS score is not available, making it unclear how frequently attackers are exploiting this flaw today. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to obtain control of a linked upstream identity and trigger the IdP‑initiated SSO flow. Once the provider restrictions are bypassed, the attacker can log in as the local user and gain full privileges within the affected systems.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Update Keycloak and all Red Hat products that contain the vulnerable SAML broker component to the latest versions released by Red Hat.
  • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
  • Verify that the required providers are not marked for link‑only when using IdP‑initiated SSO, or disable IdP‑initiated SSO for link‑only providers in the configuration.
  • Maintain awareness of Red Hat advisories by following the company’s security portal and subscribe to relevant mailing lists to receive patch information promptly.

Generated by OpenCVE AI on August 5, 2026 at 16:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Redhat build Of Keycloak
Redhat data Grid 8
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On
Vendors & Products Redhat build Of Keycloak
Redhat data Grid 8
Redhat jboss Enterprise Application Platform Expansion Pack
Redhat single Sign On
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.4::el9
cpe:/a:redhat:build_keycloak:26.6::el9
References
Type Values Removed Values Added
Description A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Title Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
First Time appeared Redhat
Redhat build Keycloak
Redhat jboss Data Grid
Redhat jbosseapxp
Redhat red Hat Single Sign On
Weaknesses CWE-346
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat jboss Data Grid
Redhat jbosseapxp
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 31, 2026, 2:47 PM
Reserved
Jul 21, 2026, 7:38 AM

View source JSON

Updated
Aug 5, 2026, 3:40 PM

JSON

Status
Analyzed
Published
Aug 5, 2026, 4:16 PM
Modified
Aug 10, 2026, 7:21 PM

View source JSON

Severity
Important
Public date
Aug 5, 2026, 2:02 AM

View source Bugzilla JSON

Updated
Aug 7, 2026, 10:06 AM

JSON