Vulnerability Details CVE-2026-16093
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 9.2%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2026-16093
-
cpe:2.3:a:redhat:build_of_keycloak:-
-
cpe:2.3:a:redhat:data_grid:8.0
-
cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-
-
cpe:2.3:a:redhat:single_sign-on:7.0