CVE-2026-1529— Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
Quick assessment
Affected
Red Hat Red Hat build of Keycloak 26.2
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在安全漏洞，该漏洞源于缺乏加密签名验证，攻击者可能通过修改邀请令牌JWT有效载荷中的组织ID和目标电子邮件，成功自注册到未经授权的组织。
In-the-Wild Activity Observed
github_trending · low
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.13-1< * |
unaffected |
26.2-15< * |
unaffected | ||
26.2-15< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.2.13 | any |
unaffected |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.9-1< * |
unaffected |
26.4-11< * |
unaffected | ||
26.4-10< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.4.9 | any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-1529
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Keycloak 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在安全漏洞，该漏洞源于缺乏加密签名验证，攻击者可能通过修改邀请令牌JWT有效载荷中的组织ID和目标电子邮件，成功自注册到未经授权的组织。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.13-1 ~ * |
cpe:/a:redhat:build_keycloak:26.2::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-15 ~ * |
cpe:/a:redhat:build_keycloak:26.2::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-15 ~ * |
cpe:/a:redhat:build_keycloak:26.2::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.2.13 | - |
cpe:/a:redhat:build_keycloak:26.2::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.9-1 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-11 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-10 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4.9 | - |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
II. Public POCs for CVE-2026-1529
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2026-1529 (PoC) is a critical vulnerability in Keycloak that allows unauthorized organization registration through improper invitation token validation. This exploit tool demonstrates the vulnerability by manipulating JWT tokens to register users in unauthorized organizations. | https://github.com/ninjazan420/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation | POC Details |
| 2 | Keycloak: Unauthorized organization registration via improper invitation token validation | https://github.com/0x240x23elu/CVE-2026-1529 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-1529
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-1529 (1)
Same Patch Batch · Red Hat · 2026-02-09 · 3 CVEs total
| CVE-2026-1486 | 8.8 HIGH | Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt |
| CVE-2025-14778 | 5.4 MEDIUM | Keycloak: incorrect ownership checks in /uma-policy/ |
IV. Related Vulnerabilities
Same product: Red Hat build of Keycloak 26.2
-
CVE-2026-7507
Org.keycloak/keycloak-services: session fixation in oidc log -
CVE-2026-7504
Org.keycloak/keycloak-services: open redirect when using wil -
CVE-2026-4636
Keycloak: keycloak: uma policy bypass allows authenticated u -
CVE-2026-4325
Keycloak: keycloak: replay of action tokens via improper han -
CVE-2026-4634
Keycloak: keycloak: denial of service via excessive processi
Same vendor: Red Hat
-
CVE-2026-110036
Device-mapper-persistent-data: device-mapper-persistent-data -
CVE-2026-88834
Busybox: busybox: httpd user existence oracle in non-default -
CVE-2026-88838
Busybox: busybox: non-root mount option filter bypass allows -
CVE-2026-88833
Busybox: busybox: udhcpc integer underflow in dhcp packet le -
CVE-2026-105460
Bluez: bluez: stack-based out-of-bounds read in btmon via un
Same weakness: CWE-347
-
CVE-2026-103297
CAI Content Credentials | Improper Verification of Cryptogra -
CVE-2026-103296
CAI Content Credentials | Improper Verification of Cryptogra -
CVE-2026-95633
CAI Content Credentials | Improper Verification of Cryptogra -
CVE-2026-102502
CAI Content Credentials | Improper Verification of Cryptogra -
CVE-2026-95632
CAI Content Credentials | Improper Verification of Cryptogra
V. Comments for CVE-2026-1529
No comments yet