Description
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Problem types
Improper Verification of Cryptographic Signature
Product status
26.2.13-1 (rpm) before *
26.2-15 (rpm) before *
26.2-15 (rpm) before *
26.4.9-1 (rpm) before *
26.4-11 (rpm) before *
26.4-10 (rpm) before *
Timeline
| 2026-01-28: | Reported to Red Hat. |
| 2026-02-09: | Made public. |
Credits
Red Hat would like to thank Joy Gilbert (gwthr) and Reynaldo Immanuel for reporting this issue.
References
access.redhat.com/errata/RHSA-2026:2363 (RHSA-2026:2363)
access.redhat.com/errata/RHSA-2026:2364 (RHSA-2026:2364)
access.redhat.com/errata/RHSA-2026:2365 (RHSA-2026:2365)
access.redhat.com/errata/RHSA-2026:2366 (RHSA-2026:2366)
access.redhat.com/security/cve/CVE-2026-1529
bugzilla.redhat.com/show_bug.cgi?id=2433783 (RHBZ#2433783)