Keycloak: Three High Severity Vulnerabilities Disclosed Together in SAML, DCR, and Auth Services
Three High severity vulnerabilities affecting Keycloak's SAML broker, DCR, and Authorization Services were disclosed in a coordinated batch on August 5, 2026.
Key findings
- Three High severity vulnerabilities disclosed together for Keycloak on August 5, 2026.
- CVE-2026-16442: SAML broker flaw allows potential bypass of account linking restrictions.
- CVE-2026-16102: DCR component allows writing to sensitive claims via User Property mappers.
- CVE-2026-15573: Authorization Services PathMatcher fails to normalize URIs, enabling policy bypass.
- Prompt update to the latest versions to address these security risks.
On August 5, 2026, a batch of three High severity vulnerabilities was disclosed for Keycloak, an open-source identity and access management solution. These vulnerabilities, impacting different components of Keycloak, were published within a one-hour window, suggesting a coordinated disclosure event. The flaws could allow attackers to gain unauthorized access or manipulate sensitive data.
One vulnerability, CVE-2026-16442, affects the SAML broker component. This flaw arises from an insufficient check in the IdP-initiated Single Sign-On endpoint, which fails to verify if a provider is restricted to account linking only. This oversight could permit an attacker who controls a linked upstream identity provider to potentially bypass authentication mechanisms.
Another High severity issue, CVE-2026-16102, resides in the Dynamic Client Registration (DCR) component. The default DCR policy has a weakness in validating the claim path for User Property mappers. This allows an attacker with standard user privileges to write values to sensitive internal claim locations, potentially leading to data corruption or unauthorized information exposure.
The third vulnerability, CVE-2026-15573, impacts Keycloak's Authorization Services. Specifically, the PathMatcher component, responsible for aligning request paths with security policies, does not correctly normalize URIs before comparison. An attacker can exploit this by appending extra characters, such as a trailing slash or matrix parameters, to a URL. This manipulation can trick the system into applying less restrictive security policies than intended, potentially granting unauthorized access to resources.
These vulnerabilities were disclosed on the same day, highlighting the importance of timely patching for Keycloak deployments. Users are advised to update to the latest versions to mitigate these risks. The coordinated disclosure of these High severity flaws underscores the need for continuous vigilance and prompt security updates in identity and access management systems.