High severity8.1NVD Advisory· Published Feb 9, 2026· Updated Apr 15, 2026
CVE-2026-1529
CVE-2026-1529
Description
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | >= 26.5.0, < 26.5.3 | 26.5.3 |
org.keycloak:keycloak-servicesMaven | < 26.2.13 | 26.2.13 |
org.keycloak:keycloak-servicesMaven | >= 26.3.0, < 26.4.9 | 26.4.9 |
Affected products
1Patches
Vulnerability mechanics
References
13- github.com/advisories/GHSA-hcvw-475w-8g7pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-1529ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:2363nvdWEB
- access.redhat.com/errata/RHSA-2026:2364nvdWEB
- access.redhat.com/errata/RHSA-2026:2365nvdWEB
- access.redhat.com/errata/RHSA-2026:2366nvdWEB
- access.redhat.com/security/cve/CVE-2026-1529nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/keycloak/keycloak/commit/82cd7941d1dd28fa14a67a6e6b912301f1a5e1a1ghsaWEB
- github.com/keycloak/keycloak/commit/8fc9a98026106a326f4faa98d4c9a48341ace2d7ghsaWEB
- github.com/keycloak/keycloak/commit/b2519756487b519f95c07aa8b10afe003e492119ghsaWEB
- github.com/keycloak/keycloak/issues/46145ghsaWEB
- github.com/keycloak/keycloak/pull/46155ghsaWEB
News mentions
0No linked articles in our index yet.