Keycloak Services: Five Vulnerabilities Including High-Severity Flaws Disclosed Together
Five vulnerabilities, including two high-severity flaws, were disclosed in Keycloak Services between August 5-6, 2026, affecting SAML, DCR, metrics, and LDAP components.
Key findings
- Five vulnerabilities in Keycloak Services disclosed together between August 5-6, 2026.
- Two high-severity flaws (CVSSv3 8.8 and 7.4) impact SAML assertion validation and DCR policy enforcement.
- Medium-severity issues affect SAML broker replay protection, user event metrics, and LDAP scope validation.
- Vulnerabilities span SAML, Dynamic Client Registration, user events, and LDAP integration components.
- Timely patching and security configuration review are crucial for Keycloak deployments.
On August 5-6, 2026, a batch of five vulnerabilities was disclosed in Keycloak Services, an open-source identity and access management solution. The vulnerabilities, spanning multiple components including SAML, Dynamic Client Registration, user event metrics, and LDAP integration, were disclosed within a 17-hour window. These issues collectively highlight potential weaknesses in how Keycloak handles authentication, authorization, and data integrity, with two rated as High severity.
One of the high-severity flaws, CVE-2026-15572, affects Keycloak's Dynamic Client Registration (DCR) security policy management. Specifically, the "Allowed Protocol Mapper Types" policy fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. This oversight could allow an attacker to potentially manipulate client configurations.
Another high-severity vulnerability, CVE-2026-16443, was found in the SAML metadata import functionality. When importing identity provider metadata that lacks specific usage attributes for keys, Keycloak incorrectly disables signature validation for SAML assertions. This could enable an attacker to potentially forge SAML assertions, leading to unauthorized access.
Two medium-severity vulnerabilities were also part of this disclosure. CVE-2026-18967 impacts the SAML broker component when configured for IdP-Initiated flow. Keycloak fails to enforce the OneTimeUse condition in SAML assertions, creating a risk of assertion replay attacks if an attacker captures a valid, unused assertion. Additionally, CVE-2026-16100 relates to user-event metrics recording. When enabled, the system logs raw error messages from failed account operations as Prometheus metric labels. Since these messages can contain user-supplied input, an authenticated user could potentially inject malicious data into metric labels, leading to a denial-of-service or information disclosure.
A fifth medium-severity vulnerability, CVE-2026-16071, was identified in the LDAP storage provider. This issue arises when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system permits lookups for users located outside the intended administrative scope, potentially exposing sensitive user information.
The disclosure of these five CVEs within a short timeframe underscores the importance of regular security audits and timely patching for Keycloak deployments. Users are advised to review the specific details of each vulnerability and apply any available updates or mitigations provided by the Keycloak project to protect their identity and access management infrastructure. The range of affected components suggests a need for a comprehensive review of security configurations across the Keycloak service.