Medium [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed.

An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that the attacker must already possess valid client credentials to perform the bypass. Successful exploitation allows an attacker to bypass mandatory signed-JWT assertion policies by providing unsigned headers.

The vulnerability's root cause is insufficient validation of the client assertion parameters and authentication method within the client policy executor. Weakness: CWE-807.

Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.