EUVD-2026-45173
GHSA-mp76-m6c2-jqh5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Delegated administrator credentials required (PR:H); integrity-only impact via unauthorized account provisioning; no confidentiality or availability loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.
AnalysisAI
Broken access control in Keycloak's organization management component allows a delegated administrator holding only organization management permissions to exploit the invitation API to provision new user accounts and inject unauthorized members into organizations. The attacker generates an invitation for a fabricated email address, then retrieves the secret registration link directly via the API - bypassing the email delivery step entirely - and uses it to self-register accounts without possessing user management permissions. No public exploit has been identified at time of analysis; exploitation is gated by the PR:H requirement (delegated administrator credentials), limiting realistic threat actors to insider or compromised-admin scenarios.
Technical ContextAI
Keycloak is Red Hat's identity and access management platform, offering delegated administration through scoped roles that allow organization managers to administer their own org without broader user management privileges. The affected component is the organization invitation workflow: when a delegated org admin invites an email address, the platform generates a secret registration link intended for the invitee. The authorization flaw is that this secret link is retrievable directly via the Keycloak API by the inviting administrator - meaning the email delivery step, which acts as a possession-of-mailbox proof, is fully bypassed. The root cause is an authorization enforcement gap (CWE not formally assigned) where the API fails to restrict retrieval of the secret token to the invited party only. Affected CPE strings span Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign-On 7, all of which share Keycloak's IAM subsystem.
RemediationAI
The primary remediation is to apply the vendor-issued patch from Red Hat; an exact fixed version is not confirmed in the available data and must be obtained directly from https://access.redhat.com/security/cve/CVE-2026-16072. As a compensating control pending patching, restrict assignment of the delegated organization management role to only the minimum set of highly trusted administrators, reducing the pool of accounts capable of exploiting this bypass - note this may impact legitimate multi-tenant administration workflows. Audit existing organization memberships and user accounts provisioned via the invitation flow to identify any unauthorized additions. Disabling the organization invitation feature entirely eliminates the attack surface but will block all invitation-based onboarding. Enable and review Keycloak admin event audit logs, specifically filtering for invitation creation events immediately followed by API-based retrieval of registration links by the same principal.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today