Bug 2501729 (CVE-2026-16093)

Summary: CVE-2026-16093 keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-17 14:08:59 UTC 
A flaw was found in the Secure Client Registration executor within the keycloak-services component. The vulnerability exists in the logic that enforces the signed-JWT assertion policy for client registration and updates. When the SecureSigningAlgorithmForSignedJwtExecutor is configured to require a client assertion, it only checks the alg field in the raw client assertion JWT header. It fails to validate that the client assertion type is present or that the client's actual authenticator is assertion-based. By providing a specially crafted request with an unsigned assertion header containing a valid alg field, an attacker with valid client credentials can bypass the signature verification check. This allows the attacker to successfully authenticate or update a client without providing the required cryptographic proof of identity. Successful exploitation allows an attacker to circumvent administrative security policies intended to restrict client authentication to trusted assertion-based methods.