CVE-2026-1529: Keycloak Services Improper Invitation Token Validation Vulnerability
Summary
CVE-2026-1529: Keycloak affected by improper invitation token validation. Affects org.keycloak:keycloak-services across 3 version ranges.
< 26.2.13
>= 26.3.0, < 26.4.9
>= 26.5.0, < 26.5.3
Fixed in 26.2.13, 26.4.9 or 26.5.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed to secure applications and services with minimal effort. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The vulnerability in question arises from improper validation of invitation tokens, which can lead to unauthorized access to organizations within Keycloak.
Vulnerability Detail
A flaw was discovered in Keycloak's handling of invitation tokens. Specifically, an attacker can manipulate the organization ID and target email in a legitimate invitation token's JSON Web Token (JWT) payload. This vulnerability stems from the lack of cryptographic signature verification, allowing attackers to self-register into unauthorized organizations, thereby gaining access to sensitive resources and data.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 26.2.1326.2.13 -
>= 26.3.0, < 26.4.926.4.9 -
>= 26.5.0, < 26.5.326.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, organizations can implement additional checks on the server-side to validate invitation tokens before processing them. This can include verifying the integrity of the JWT and ensuring that the organization ID matches the expected value.
Conclusion
The improper invitation token validation vulnerability in Keycloak poses significant risks, allowing unauthorized access to organizations. It is crucial for users to update to the patched versions to safeguard their applications and data. Implementing additional validation checks can provide temporary relief until updates are applied.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data and resources within an organization, potentially compromising user accounts and data integrity.
While updating is the most effective solution, implementing additional server-side validation checks can serve as a temporary workaround.
The vulnerability affects Keycloak versions starting from 26.5.0 up to 26.5.2, as well as earlier versions up to 26.2.12 and 26.3.0 to 26.4.8.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
