Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-16442

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.14-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-22 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-22 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.14

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4.14

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6.5-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-11 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6

Default version status: affected

  • 26.6-11 to < *unaffected

Red Hat Red Hat build of Keycloak 26.6.5

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6.5

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.6.5

Default version status: unaffected

Red Hat Red Hat Data Grid 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

References