CVE-2026-16442 — Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single…
Published: 2026-08-05 · CVSS: 7.4 · CVSS 3.1
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7