Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Keycloak の SAML ブローカーで、管理者が付けた「このIdPは連結専用」の制限が IdP起点SSOでは効きません。連結済みの上流を握られると本人としてログインされます。回避策は無し。修正は 26.4.14 / 26.6.5 / 26.7.1 / 26.8.0。 https://cve.autoarticles.net/cve/CVE-2026-16442
Post summary
The CVE describes a Keycloak SAML broker flaw that lets attackers log in without authorization via IdP‑initiated SSO; no PoC or exploitation is cited, but a patch exists in specified releases.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |