CVE-2026-16093: redhat build_of_keycloak

Vulnerability summary

CVE-2026-16093 is a medium (CVSS 5.4) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.

Timeline

1. 17-07-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.

• CWE-807Reliance on Untrusted Inputs in a Security DecisionThe product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.