CVE-2026-16443 is a high severity (CVSS 7.4) flaw in Red Hat build of Keycloak. Importing SAML metadata with certain key entries leaves signature validation off, so forged SAML responses can be accepted. Red Hat fixed it in 26.4.14 and 26.6.5. Update, then audit every SAML identity provider you imported.
What's affected
Red Hat build of Keycloak, in the keycloak-services component that parses SAML identity provider metadata. Red Hat's errata RHSA-2026:50846 to RHSA-2026:50849 list this CVE and cover releases 26.4.14 and 26.6.5, as server packages and as OpenShift images. Red Hat states that mitigation is not available at the level it requires, so patching is the route.
The risky condition is an identity provider created by importing a metadata document that sets WantAuthnRequestsSigned to false and has a KeyDescriptor with no explicit use attribute. Providers configured by hand, or imported from metadata that states key usage, may not be in that state. You still need to verify, because the advisory does not say how to find affected providers beyond that condition.
How to check if you're exposed
For each realm, open every SAML identity provider that was created from imported metadata and check the signature validation setting. If validation is off on a provider that has a signing certificate, treat it as affected until you have patched and turned it on.
You can compare against the original metadata files too. Look for a KeyDescriptor element that has no use attribute, together with WantAuthnRequestsSigned set to false.
Last, confirm the Keycloak version against 26.4.14 and 26.6.5.
What to do now
- Record the version of every Red Hat build of Keycloak server and image.
- Apply the matching update from RHSA-2026:50846 to 50849.
- Open each imported SAML identity provider and confirm signature validation is enabled.
- Where it was off, review logins through that provider since it was created, and consider ending sessions.
- Reimport metadata only after the update, and recheck the setting afterward.
Why it matters
The weakness is CWE-347 (Improper Verification of Cryptographic Signature). When the metadata parser saw a key entry with no stated use, it stored the certificate but did not switch on the validateSignature flag. The broker endpoint then accepted a SAML response without verifying who signed it.
The advisory describes an unauthenticated attacker who captures a valid RelayState and request ID through a normal login flow, then submits a forged response naming a linked user. The vector marks complexity as high for that reason. The result is impersonation of any federated user. CISA does not list this CVE as known exploited, and Red Hat reports no exploitation.
Quick check
Why audit providers if I am patching?
Patching fixes the parser for future imports. Providers that were imported earlier may still carry the wrong setting, so check each one.
Sources
Last reviewed: 19 October 2026.
