Red Hat Keycloak CVE-2026-16093
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L reflects mandatory valid client credentials; C:L/I:L captures token issuance under bypassed policy; A:N as no availability impact is described.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
AnalysisAI
Keycloak's Client Policies enforcement mechanism - designed to mandate stronger OAuth/OIDC client authentication such as signed JWTs (RFC 7523) - can be bypassed by any attacker who already holds valid client credentials. By supplying a crafted, unsigned assertion header in the token request, the attacker causes Keycloak to evaluate policy compliance as satisfied without performing cryptographic verification, allowing authentication to proceed via a weaker method such as a plain client secret. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must already possess valid client credentials (client_id and client_secret) for a registered Keycloak client - PR:L in the CVSS vector confirms this authenticated prerequisite; (2) the target Keycloak realm must have Client Policies explicitly configured to enforce signed JWT client authentication (private_key_jwt or similar); realms that rely on default client_secret authentication are not affected because no stronger requirement exists to bypass; and (3) the attacker must be able to reach the Keycloak token endpoint over the network (AV:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects the bounded nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid client credentials (client_id and client_secret) for a Keycloak client in a realm where Client Policies mandate signed JWT assertions constructs a token request containing a forged, unsigned assertion header designed to pass the policy compliance check. Keycloak's policy evaluator accepts the header at face value without verifying the cryptographic signature, classifies the requirement as met, and issues access tokens via the weaker client_secret grant - bypassing the administrator-configured security requirement entirely. … |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-16093 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2501729 for patched package versions; no exact fixed version number is confirmed in the currently available intelligence, so checking the advisory directly is mandatory before acting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today