Read the docs
TI-2026-01219 Aliases CVE-2026-1529GHSA-hcvw-475w-8g7p

Improper signature verification in Red Hat build of Keycloak 26.2

Priority LOW 36CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00494 42nd percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 26.5.3, 26.2.13, 26.4.9Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 26.2—26.2.13-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.2—26.2-15Patch availableCNA
Red HatRed Hat build of Keycloak 26.2—26.2-15Patch availableCNA
Red HatRed Hat build of Keycloak 26.2.13——Not affectedCNA
Red HatRed Hat build of Keycloak 26.4—26.4.9-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-11Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-10Patch availableCNA
Red HatRed Hat build of Keycloak 26.4.9——Not affectedCNA
—org.keycloak:keycloak-services (Maven)26.5.0 to before 26.5.326.5.3Patch availableGHSA-hcvw-475w-8g7p
—org.keycloak:keycloak-services (Maven)before 26.2.1326.2.13Patch availableGHSA-hcvw-475w-8g7p
—org.keycloak:keycloak-services (Maven)26.3.0 to before 26.4.926.4.9Patch availableGHSA-hcvw-475w-8g7p
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2.13-1 Patch available CNA
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-15 Patch available CNA
  • Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-15 Patch available CNA
  • Red Hat build of Keycloak 26.2.13 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.9-1 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-11 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-10 Patch available CNA
  • Red Hat build of Keycloak 26.4.9 VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.keycloak:keycloak-services (Maven) Vendor— Affected 26.5.0 to before 26.5.3 Fixed in 26.5.3 Patch available GHSA-hcvw-475w-8g7p
  • org.keycloak:keycloak-services (Maven) Vendor— Affected before 26.2.13 Fixed in 26.2.13 Patch available GHSA-hcvw-475w-8g7p
  • org.keycloak:keycloak-services (Maven) Vendor— Affected 26.3.0 to before 26.4.9 Fixed in 26.4.9 Patch available GHSA-hcvw-475w-8g7p

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.2::el926.2—Red Hat
cpe:/a:redhat:build_keycloak:26.4::el926.4—Red Hat
  • cpe:/a:redhat:build_keycloak:26.2::el9 Versions 26.2 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat

Remediation

  • Fix · GHSA-hcvw-475w-8g7p org.keycloak:keycloak-services (Maven) Fixed in 26.5.3 Advisory →
  • Fix · GHSA-hcvw-475w-8g7p org.keycloak:keycloak-services (Maven) Fixed in 26.2.13 Advisory →
  • Fix · GHSA-hcvw-475w-8g7p org.keycloak:keycloak-services (Maven) Fixed in 26.4.9 Advisory →

Red Hat 4 advisories

  • RHSA-2026:2364 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.2.13 Images Security Update
    • Red Hat build of Keycloak 26.2 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:2366 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.9 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:2365 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.9 Security Update
    • Red Hat build of Keycloak 26.4.9
Show 1 more Red Hat advisories
  • RHSA-2026:2363 Released 2026-02-09 · Red Hat rating Important
    Red Hat build of Keycloak 26.2.13 Security Update
    • Red Hat build of Keycloak 26.2.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.13 and 2 more products — RHSA-2026:2363

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-13491 Keycloak: incorrect ownership checks in /uma-policy/Priority LOW 24
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.13 and 2 more products — RHSA-2026:2364

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-13491 Keycloak: incorrect ownership checks in /uma-policy/Priority LOW 24
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.2Fixed RHSA-2026:2364
Red Hat build of Keycloak 26.2.13Fixed RHSA-2026:2363
Red Hat build of Keycloak 26.4Fixed RHSA-2026:2366
Red Hat build of Keycloak 26.4.9Fixed RHSA-2026:2365

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1529
  2. 2026-10-03 Alias added: GHSA-hcvw-475w-8g7p

References

Advisory 5

Other 8

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences