CVE-2026-16442

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

7.4 HighFix available

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.31%Up 0.1 points since Aug 6, 2026

What each source reports

CVE List Score used 7.4

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Record: CVE-2026-16442
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-346
Updated: 2026-11-02

EUVDEUVD-2026-53395 7.4

Record: EUVD-2026-53395
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vj6m-hv26-qx79 7.4

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity...

Record: GHSA-vj6m-hv26-qx79
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-346
Updated: 2026-11-02

NVD 7.4

Record: CVE-2026-16442
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-346
Updated: 2026-11-02

OSVBIT-keycloak-2026-16442 No score

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Record: BIT-keycloak-2026-16442
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`keycloak` Bitnami	26.4.0 up to 26.4.14, 26.6.0 up to 26.6.5	26.4.1426.6.5

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16442 is a high vulnerability (CVSS 7.4) in Red Hat Build Of Keycloak 26.4, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in keycloak 26.4.14.