CVE-2026-1529: Keycloak affected by improper invitation token validation
(updated )
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token’s JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
References
- access.redhat.com/errata/RHSA-2026:2363
- access.redhat.com/errata/RHSA-2026:2364
- access.redhat.com/errata/RHSA-2026:2365
- access.redhat.com/errata/RHSA-2026:2366
- access.redhat.com/security/cve/CVE-2026-1529
- bugzilla.redhat.com/show_bug.cgi?id=2433783
- github.com/advisories/GHSA-hcvw-475w-8g7p
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/82cd7941d1dd28fa14a67a6e6b912301f1a5e1a1
- github.com/keycloak/keycloak/commit/8fc9a98026106a326f4faa98d4c9a48341ace2d7
- github.com/keycloak/keycloak/commit/b2519756487b519f95c07aa8b10afe003e492119
- github.com/keycloak/keycloak/issues/46145
- github.com/keycloak/keycloak/pull/46155
- nvd.nist.gov/vuln/detail/CVE-2026-1529
Code Behaviors & Features
Detect and mitigate CVE-2026-1529 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →