8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1529

CVE-2026-1529: Keycloak affected by improper invitation token validation

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1529

CVE-2026-1529:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-services	maven	< 26.5.3	26.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper validation of JSON Web Tokens (JWTs) used for organization invitations in Keycloak. The root cause is the org.keycloak.organization.utils.Organizations.parseInvitationToken function, which decoded the JWT without verifying its cryptographic signature. This allowed an attacker to take a legitimate invitation token, modify its payload to change the target organization ID and email, and use this tampered token to register a new user into an organization of their choice.

The vulnerable parseInvitationToken function was called from multiple places within the registration flow, including RegistrationPage.render (when the registration page is displayed) and RegistrationUserCreation.validateOrganizationInvitation (when the user is being created). The LoginActionsService.registerRequest method, which controls the registration flow, was also modified to ensure that token validation happens before any registration actions are taken.

The patch addresses this vulnerability by replacing the insecure token parsing with a new implementation that performs proper signature verification using SignatureVerifierContext. This ensures that any tampered tokens are detected and rejected, preventing unauthorized access.

Vulnerable functions

org.keycloak.organization.utils.Organizations.parseInvitationToken

services/src/main/java/org/keycloak/organization/utils/Organizations.java

This function was vulnerable because it used `TokenVerifier.create(token, Class).getToken()` to parse a JWT token from an invitation link without verifying its cryptographic signature. This allowed an attacker to modify the token's payload (e.g., the organization ID and email) and have it accepted by the system, leading to unauthorized access to organizations.

org.keycloak.authentication.forms.RegistrationPage.render

services/src/main/java/org/keycloak/authentication/forms/RegistrationPage.java

This function was part of the vulnerable execution flow. It called the vulnerable `Organizations.parseInvitationToken` method to process an invitation token when rendering the user registration page. This meant that a user could arrive at the registration page with a tampered token, and the system would not detect the tampering at this stage.

org.keycloak.authentication.forms.RegistrationUserCreation.validateOrganizationInvitation

services/src/main/java/org/keycloak/authentication/forms/RegistrationUserCreation.java

This function was part of the vulnerable execution flow. It was called during the user creation process and used the vulnerable `Organizations.parseInvitationToken` method to validate the organization invitation. This allowed a user to complete registration with a tampered token, effectively joining an organization they were not invited to.

org.keycloak.services.resources.LoginActionsService.registerRequest

services/src/main/java/org/keycloak/services/resources/LoginActionsService.java

This function orchestrates the user registration flow. The patch modified this function to ensure that the invitation token is validated *before* the registration process begins. Previously, the token validation was not properly enforced, allowing a user to proceed with registration using a potentially malicious token. The change ensures that `preHandleActionToken` is called and its response is checked, which aborts the flow if the token is invalid.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.