THREAT OPS › Threat News › [NVD] CVE-2026-16093 (MEDIUM 5.4) — Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fa
[NVD] CVE-2026-16093 (MEDIUM 5.4) — Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fa
CVE-2026-16093 CVSS: 5.4 MEDIUM Published: 2026-07-17T17:17:14.133
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-16093cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16093