EUVD-2026-45173
GHSA-mp76-m6c2-jqh5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Delegated administrator credentials required (PR:H); integrity-only impact via unauthorized account provisioning; no confidentiality or availability loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.
AnalysisAI
Broken access control in Keycloak's organization management component allows a delegated administrator holding only organization management permissions to exploit the invitation API to provision new user accounts and inject unauthorized members into organizations. The attacker generates an invitation for a fabricated email address, then retrieves the secret registration link directly via the API - bypassing the email delivery step entirely - and uses it to self-register accounts without possessing user management permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold an active Keycloak delegated administrator account with explicit organization management permissions - this is not a default or low-barrier role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.9 score (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) accurately captures the primary risk limiter: PR:H requires the attacker to already hold a delegated administrator account with explicit organization management permissions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A delegated Keycloak organization administrator - granted org management but not user management permissions - sends an invitation to a fabricated, non-existent email address. Rather than waiting for (or relying on) email delivery, the administrator immediately queries the Keycloak API to retrieve the secret registration token embedded in that invitation. … |
| Remediation | The primary remediation is to apply the vendor-issued patch from Red Hat; an exact fixed version is not confirmed in the available data and must be obtained directly from https://access.redhat.com/security/cve/CVE-2026-16072. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today