CVE-2026-16443

Katalog CVE

CVSS 9.1 · Critical EPSS 0,26%

Kerentanan Improper Verification of Cryptographic Signature pada redhat build of keycloak. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

10 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:50846 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50847 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50848 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50849 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-16443 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2503139 issue tracking · advisory vendor