Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to improper validation of client authentication assertions, which allows an attacker with valid client credentials to supply a fake unsigned assertion header and bypass policies requiring signed JWT authentication...

CVE-2026-16093

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...

CVE-2026-16093: Reliance on Untrusted Inputs in a Security Decision

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...