Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-1529GHSA-HCVW-475W-8G7P

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 26.5.3, 26.2.13, 26.4.9
3 proofs of concept on GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • rhbk/keycloak-operator-bundle

    Version range not reported

  • rhbk/keycloak-rhel9

    Version range not reported

  • rhbk/keycloak-rhel9-operator

    Version range not reported

  • rhbk/keycloak-rhel9

    Version range not reported

  • rhbk/keycloak-operator-bundle

    Version range not reported

  • rhbk/keycloak-rhel9

    Version range not reported

  • rhbk/keycloak-rhel9-operator

    Version range not reported

  • rhbk/keycloak-rhel9

    Version range not reported

  • org.keycloak:keycloak-servicesMaven

    From 26.5.0 · fixed in 26.5.3

  • org.keycloak:keycloak-servicesMaven

    fixed in 26.2.13

  • org.keycloak:keycloak-servicesMaven

    From 26.3.0 · fixed in 26.4.9

References 9

access.redhat.com

bugzilla.redhat.com

GitHub · 0x240x23elu/CVE-2026-1529

GitHub · 0xlyvio/CVE-2026-1529-Keycloak-Exploit-Tool

GitHub · ackemed/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation