CVE-2026-1529

highpriority · track · 10EPSS 0.005 · 42 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · PoC

Likely / severe?

0.49% (42nd) EPSS

CVSS 8.1 · high

Is it mine?

18 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347USCWE-347US

exploits (3)

Public proof-of-concept and weaponised exploit code.

affected products (18)

Products and version ranges known to be affected.

Dell ECS 3.8.1.0-3.8.1.7all versionscert_bundDEcpe:/h:dell:ecs:3.8.1.0_-_3.8.1.7
Open Source Keycloak <26.5.3all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Open Source Keycloak< 26.5.3cert_bundDE
Red Hat Enterprise Linux≤ Keycloak Operator <26.2.13cert_bundDE
Red Hat Enterprise Linux≤ Keycloak <26.2.13cert_bundDE
Red Hat Red Hat build of Keycloak 26.2< 26.2-15enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.2< 26.2.13-1enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4-10enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4-11enisa_euvdEU
Red Hat Red Hat build of Keycloak 26.4< 26.4.9-1enisa_euvdEU
Red Hat Inc. Red Hat Build of Keycloak≤ 26.4.9fstec_bduRU
Red Hat Inc. Red Hat Build of Keycloak≤ 26.4fstec_bduRU
Red Hat Inc. Red Hat Build of Keycloak≤ 26.2.13fstec_bduRU
Red Hat Inc. Red Hat Build of Keycloak≤ 26.2fstec_bduRU
Maven org.keycloak:keycloak-services< 26.2.13osvUSpkg:maven/org.keycloak/keycloak-services
Maven org.keycloak:keycloak-services26.3.0 → 26.4.9osvUSpkg:maven/org.keycloak/keycloak-services
Maven org.keycloak:keycloak-services26.5.0 → 26.5.3osvUSpkg:maven/org.keycloak/keycloak-services

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0347Red Hat Build of Keycloak: Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Build of Keycloak ausnutzen, um die Authentifizierung zu umgehen, erweiterte Berechtigungen zu erlangen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen oder Daten zu manipulieren.
WID-SEC-W-2026-0356Keycloak: Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.
GHSA-hcvw-475w-8g7pKeycloak affected by improper invitation token validation2026-02-09ghsa · osvUS
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2026-02-09modified 2026-07-15

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan