CVE-2026-1529

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:2363
https://access.redhat.com/errata/RHSA-2026:2364
https://access.redhat.com/errata/RHSA-2026:2365
https://access.redhat.com/errata/RHSA-2026:2366
https://access.redhat.com/security/cve/CVE-2026-1529
https://bugzilla.redhat.com/show_bug.cgi?id=2433783

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-09 20:15

Updated : 2026-02-10 02:15

NVD link : CVE-2026-1529

Mitre link : CVE-2026-1529

CVE.ORG link : CVE-2026-1529

JSON object : View

Products Affected

No product.

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-1529", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2026-02-09T20:15:55.883", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:2363", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:2364", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:2365", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:2366", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-1529", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433783", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Keycloak. Un atacante puede explotar esta vulnerabilidad modificando el ID de la organizaci\u00f3n y el correo electr\u00f3nico de destino dentro de la carga \u00fatil (payload) de un JSON Web Token (JWT) de un token de invitaci\u00f3n leg\u00edtimo. Esta falta de verificaci\u00f3n de firma criptogr\u00e1fica permite al atacante registrarse exitosamente en una organizaci\u00f3n no autorizada, lo que lleva a un acceso no autorizado."}], "lastModified": "2026-02-10T02:15:52.253", "sourceIdentifier": "secalert@redhat.com"}