What is the CVSS score of EUVD-2026-53343?

EUVD-2026-53343 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Red Hat Keycloak are affected by EUVD-2026-53343?

Red Hat's Keycloak and Single Sign-On 7 contain a critical authentication flaw allowing unauthenticated attackers to forge SAML responses and hijack user accounts when identity-provider metadata…. A patch is available.

How to fix or mitigate EUVD-2026-53343?

Within 24 hours, identify all systems running Red Hat Build of Keycloak or Red Hat Single Sign-On 7 and audit their SAML identity-provider configurations to determine exposure. Within 7 days, apply the vendor-released patch to all affected instances in your environment-prioritize production systems and deployment. Within 30 days, conduct a comprehensive review of all SAML provider integrations to ensure metadata was imported with proper key-usage attributes; for any providers imported without these attributes, re-import with corrected configurations.

Red Hat Keycloak EUVD-2026-53343

| CVE-2026-16443 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-05 redhat

GHSA-v5j7-jp89-37vr

Authentication Bypass Red Hat Jwt Attack Red Hat Build Of Keycloak Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Single Sign On 7 Red Hat Data Grid 8 Red Hat

9.1

CVSS 3.1 · NVD

Severity by source

Vendor (redhat) PRIMARY

HIGH

qualitative

NVD

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated SAML forgery (AV:N/PR:N/UI:N); low complexity given disabled validation, though it needs a specific misconfigured IdP; full account takeover impacts C and I, not availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 10, 2026 - 19:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 10, 2026 - 19:07 vuln.today

cvss_changed

Severity Changed

Aug 10, 2026 - 19:07 NVD

HIGH CRITICAL

CVSS changed

Aug 10, 2026 - 19:07 NVD

7.4 (HIGH) 9.1 (CRITICAL)

Analysis Generated

Aug 05, 2026 - 14:07 vuln.today

CVE Published

Aug 05, 2026 - 13:44 cve.org

HIGH 7.4

DescriptionNVD

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

AnalysisAI

Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.

Technical ContextAI

The flaw lives in Keycloak's SAML 2.0 identity-brokering layer (keycloak-services), which lets Keycloak act as a Service Provider trusting an external SAML Identity Provider. In SAML, an IdP's metadata <KeyDescriptor> elements carry an optional use attribute (use="signing" or use="encryption"). When metadata is imported without these usage attributes, Keycloak fails to register the certificate as a signing key and incorrectly treats the response's signature as optional, so it accepts forged assertions. This maps to CWE-347 (Improper Verification of Cryptographic Signature): the trust anchor exists but the code path that binds it to signature enforcement is not exercised. CPE data confirms the affected code ships in Red Hat Build of Keycloak, Red Hat Single Sign-On 7, the JBoss EAP Expansion Pack, and is bundled with Red Hat Data Grid 8.

RemediationAI

Vendor-released patch: upgrade Red Hat Build of Keycloak to 26.6.5-1 (or 26.6-11) or 26.4.14-1 (or 26.4-22) per RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849 (https://access.redhat.com/errata/RHSA-2026:50846); apply the corresponding Red Hat Single Sign-On 7, JBoss EAP Expansion Pack, and Data Grid 8 errata. As a compensating control until patched, re-import each external SAML identity provider's metadata ensuring the <KeyDescriptor> includes an explicit use="signing" attribute, or manually configure the signing certificate and enable 'Validate Signature' / 'Want Assertions Signed' on the IdP definition so signature enforcement cannot be silently disabled - the trade-off is manual per-IdP review and potential brokering downtime if a certificate is misconfigured. Where feasible, temporarily disable affected SAML brokering connections, accepting loss of that federated login path, until validation is confirmed enforced.