A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
References
Configurations
No configuration.
History
15 Apr 2026, 00:35
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
10 Feb 2026, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Feb 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Feb 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-09 20:15
Updated : 2026-04-15 00:35
NVD link : CVE-2026-1529
Mitre link : CVE-2026-1529
CVE.ORG link : CVE-2026-1529
JSON object : View
Products Affected
No product.
CWE
CWE-347
Improper Verification of Cryptographic Signature