What is the CVSS score of CVE-2026-1529?

CVE-2026-1529 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-1529?

Keycloak organizations using invitation tokens face unauthorized access risk, as attackers can redirect invitations to different email addresses and organizations by modifying JWT payloads.. A patch is available.

How to fix or mitigate CVE-2026-1529?

Within 24 hours: Inventory all Keycloak deployments and disable organization invitation features if not business-critical. Within 7 days: Implement JWT validation and WAF rules to detect suspicious token modifications; audit invitation logs for anomalies. Within 30 days: Establish a process for JWT token signing verification, implement API rate limiting on invitation endpoints, and isolate Keycloak from untrusted networks until a patch is available.

Jwt Attack CVE-2026-1529

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-02-09 secalert@redhat.com

GHSA-hcvw-475w-8g7p

Authentication Bypass Jwt Attack

8.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 09, 2026 - 20:15 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.0.

DescriptionCVE.org

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

AnalysisAI

Keycloak's invitation token validation fails to cryptographically verify JWT payload modifications, allowing authenticated attackers to alter organization IDs and email addresses to register into unauthorized organizations. This enables unauthorized access to organizations without proper authentication, affecting any Keycloak deployment using the invitation feature. No patch is currently available.

Technical ContextAI

Classified as CWE-347 (Improper Verification of Cryptographic Signature). A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.