Log in Start free

Vulnerability · Published Feb 9, 2026 · Assigned by redhat

CVE-2026-1529Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

High 8.1

In plain English

A high-severity security flaw in Red Hat build of Keycloak 26.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 57.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-services26.5.3GHSA-hcvw-475w-8g7p
Mavenorg.keycloak:keycloak-services26.2.13GHSA-hcvw-475w-8g7p
Mavenorg.keycloak:keycloak-services26.4.9GHSA-hcvw-475w-8g7p

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2.13 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4 see references
Red Hat Red Hat build of Keycloak 26.4.9 see references

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References