Is CVE-2026-16093 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16093 being exploited in the wild.

How severe is CVE-2026-16093?

Medium severity, with a CVSS score of 5.4, published 17 July 2026.

Which products and versions are affected?

Red Hat Build of Keycloak; Red Hat Single Sign-On 7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.

Is there a fix for CVE-2026-16093?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16093 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16093?

Check whether you run Red Hat build of Keycloak, Red Hat Data Grid 8 or Red Hat Single Sign-On 7. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16093: Red Hat Keycloak Client Policy bypass in keycloak-services

CVE-2026-16093 · Severity: medium · CVSS 5.4 · Published 2026-07-17

Keycloak, a popular identity and access management solution, contains a flaw in its security policy enforcement. Administrators can set policies requiring clients to use secure, signed digital signatures (JWTs) for authentication; however, this protection can be bypassed. An attacker with basic client credentials can use a fake, unsigned header to trick the system into accepting less secure authentication methods, potentially undermining the organization's security standards for application access.

Technologies: Red Hat build of Keycloak, Red Hat Data Grid 8, Red Hat Single Sign-On 7. Vendors: Red Hat.

Quick answers

Is CVE-2026-16093 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16093 being exploited in the wild.
How severe is CVE-2026-16093?: Medium severity, with a CVSS score of 5.4, published 17 July 2026.
Which products and versions are affected?: Red Hat Build of Keycloak; Red Hat Single Sign-On 7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Is there a fix for CVE-2026-16093?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16093 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16093?: Check whether you run Red Hat build of Keycloak, Red Hat Data Grid 8 or Red Hat Single Sign-On 7. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Secure Client Registration executor within the keycloak-services component allows for a bypass of the signed-JWT assertion policy. The root cause is located in the SecureSigningAlgorithmForSignedJwtExecutor, which incorrectly validates only the 'alg' field in the raw JWT header without verifying the presence of a valid client assertion type or ensuring the client's authenticator is assertion-based. By submitting a crafted request with an unsigned assertion header containing a valid 'alg' field, an authenticated attacker can bypass signature verification. This enables the use of simpler authentication methods (like client secrets) even when administrative policies mandate signed assertions.

Affected products

Red Hat Build of Keycloak
Red Hat Single Sign-On 7
Red Hat Data Grid 8
Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

2026-07-17: disclosed
2026-07-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.