CVE-2026-1529: JWT Token Manipulation in Keycloak

The core of this vulnerability lies in the insufficient validation of parameters within Keycloak's invitation token handling. An attacker can craft a malicious JWT by modifying the 'organization ID' and 'target email' fields within the token's payload. Because Keycloak fails to properly verify the cryptographic signature of the token, it accepts these modified values, allowing the attacker to effectively self-register into an organization they are not authorized to access. This bypasses the intended access control mechanisms. The potential impact is significant, ranging from unauthorized access to user data and administrative functions to potential data breaches and system compromise. This vulnerability shares similarities with other JWT manipulation attacks where inadequate validation of token claims leads to privilege escalation.

1. Reserved2026-01-28
2. Published2026-02-09
3. Modified2026-02-16
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1529 is to upgrade Keycloak to a version containing the security patch. As a temporary workaround, consider implementing stricter input validation on the server-side to scrutinize the organization ID and target email parameters within invitation tokens. Additionally, implement a Web Application Firewall (WAF) rule to detect and block requests containing suspicious JWT payloads with altered organization IDs or email addresses. Regularly review Keycloak's audit logs for any unusual self-registration attempts. After upgrading, confirm the fix by attempting to craft and use a modified invitation token; it should be rejected.