CVE-2026-16442 is a high severity (CVSS 7.4) login bypass in Red Hat build of Keycloak. The SAML IdP-initiated endpoint ignores the link-only setting on an identity provider. Red Hat shipped fixes in build 26.4.14 and 26.6.5, so update and review any provider you set to link-only.
What's affected
Red Hat build of Keycloak, in the SAML broker component. Red Hat's errata RHSA-2026:50846 to RHSA-2026:50849 list this CVE and cover the 26.4.14 and 26.6.5 releases, both as server packages and as OpenShift images. Red Hat says no mitigation is available that meets its criteria, so the update is the fix.
The setting involved is linkOnly on a SAML identity provider. Realms that have no SAML identity providers set to link-only are not exposed to this specific bypass. Check the Red Hat CVE page for the status of other build lines you run.
How to check if you're exposed
List the SAML identity providers in each realm and note which ones are link-only. In the admin console this is under Identity providers. You can also read the realm configuration with the admin CLI and look for linkOnly.
Then find out which of those providers already have users linked to them. The advisory describes an attacker who controls an upstream SAML identity that is linked to a local user, so a link-only provider with linked accounts is the case to fix first.
Finally check the server version. Compare it with 26.4.14 and 26.6.5 in the Red Hat errata.
What to do now
- Find every Red Hat build of Keycloak server and image, and record its version.
- Apply the update from RHSA-2026:50846 to 50849 that matches your release line.
- List link-only SAML identity providers and review who has linked accounts to them.
- Review sign-in logs for logins that came through a link-only provider.
- Recheck the Red Hat CVE page for any other builds you run.
Why it matters
The weakness is CWE-346 (Origin Validation Error). Keycloak has a rule that a link-only provider may connect an existing account, but may not be used to sign in. The IdP-initiated endpoint, /realms/{realm}/broker/{alias}/endpoint/clients/{client_id}, did not apply that rule, so a valid signed response from a linked upstream identity produced a full session as the local user.
The impact is account takeover for any user linked to such a provider, which is why Red Hat rates it Important. The vector marks attack complexity as high, since the attacker must control a linked upstream identity. CISA does not list this CVE as known exploited, and Red Hat's pages do not report exploitation.
Quick check
Is a link-only provider safe to keep?
Yes once you patch. The point of the setting is to allow linking without login, and the fix makes the IdP-initiated endpoint respect it.
Sources
Last reviewed: 19 October 2026.
