Description
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2.13 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-26.4-iamguarded-compat | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
0x240x23elu/CVE-2026-1529 ★ 6 · Feb 11, 2026
Keycloak: Unauthorized organization registration via improper invitation token validation
-
0xlyvio/CVE-2026-1529-Keycloak-Exploit-Tool ★ 3 · Sep 5, 2026
Keycloak: Unauthorized organization registration via improper invitation token validation
-
ackemed/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation ★ 0 · Feb 13, 2026
CVE-2026-1529 (PoC) is a critical vulnerability in Keycloak that allows unauthorized organization registration through improper invitation token validation. This exploit tool demonstrates the vulnera…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | >= 26.5.0, < 26.5.3 | 26.5.3 | GHSA-hcvw-475w-8g7p |
| Maven | org.keycloak:keycloak-services | < 26.2.13 | 26.2.13 | GHSA-hcvw-475w-8g7p |
| Maven | org.keycloak:keycloak-services | >= 26.3.0, < 26.4.9 | 26.4.9 | GHSA-hcvw-475w-8g7p |
Advisories 2
- WID-SEC-2026-0356 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2026
- WID-SEC-2026-0347 Red Hat Build of Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
References
- RHSA-2026:2363 vendor-advisory
- RHSA-2026:2364 vendor-advisory
- RHSA-2026:2365 vendor-advisory
- RHSA-2026:2366 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-1529 vdb-entry
- RHBZ#2433783 issue-tracking