5.4Medium
CVE-2026-16093Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers
Description
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
Weakness (CWE):
CWE-807
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| build keycloak | 26.6 | — | |
| redhat | build of keycloak | — | |
| redhat | data grid | 8.0 | |
| redhat | jboss enterprise application platform expansion pack | — | |
| Red Hat | Red Hat build of Keycloak 26.6 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — | |
| Red Hat | Red Hat Data Grid 8 | all versions | |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | all versions | |
| Red Hat | Red Hat Single Sign-On 7 | all versions | |
| redhat | single sign-on | 7.0 |
References and patches
- RHSA-2026:68277 vendor-advisory
- RHSA-2026:68278 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-16093 vdb-entryVendor Advisory
- RHBZ#2501729 issue-trackingIssue TrackingVendor Advisory
CPE matches (NVD) (4)
cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*