A vulnerability was identified in Keycloak where the SAML Identity Provider IdP metadata parser incorrectly configures signature validation. When a metadata document is imported that sets WantAuthnRequestsSigned to false and includes a KeyDescriptor without an explicit use attribute, the parser stores the certificate but fails to enable the validateSignature setting.
As a result, the broker endpoint /realms/realm/broker/alias/endpoint does not verify the cryptographic signature of incoming SAML responses. An unauthenticated remote attacker can exploit this by capturing a valid RelayState and SAML request ID through a standard login flow and then submitting a forged, unsigned SAML response. By providing the external SAML NameID of a target user, the attacker can successfully authenticate as that user.
Successful exploitation allows an attacker to:
Bypass authentication mechanisms.

Impersonate any user who has a federated identity link.

Access and modify data belonging to the compromised user account.