A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
red hat:red hat single sign-on 7
red hat:red hat data grid 8
red hat:red hat jboss enterprise application platform expansion pack
red hat:red hat build of keycloak
References 6
https://access.redhat.com/security/cve/CVE-2026-16443
NVD
https://bugzilla.redhat.com/show_bug.cgi?id=2503139
RHBZ#2503139
https://access.redhat.com/errata/RHSA-2026:50846
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50847
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50848
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50849
secalert@redhat.com