Cyber Posture

CVE-2026-1529

High

Published: 09 February 2026

Published
09 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0001 1.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1529 is a high-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Mandates implementation of cryptographic mechanisms, including digital signatures, to prevent unauthorized modification of JWT payloads in invitation tokens.

preventdetect

Requires use of digital signatures and integrity verification to detect unauthorized alterations to information such as JWT invitation token payloads.

prevent

Ensures timely remediation of specific flaws like improper cryptographic signature verification on JWTs through patching and flaw correction.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

JWT signature bypass enables privilege escalation to unauthorized orgs (T1068) via exploitation of public-facing Keycloak (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to…

more

successfully self-register into an unauthorized organization, leading to unauthorized access.

Deeper analysisAI

CVE-2026-1529, published on 2026-02-09, is a vulnerability in Keycloak stemming from a lack of cryptographic signature verification on JSON Web Token (JWT) payloads in legitimate invitation tokens. An attacker can modify the organization ID and target email within such a token, enabling successful self-registration into an unauthorized organization and resulting in unauthorized access. The flaw is rated at CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and maps to CWE-347 (Improper Verification of Cryptographic Signature).

The attack requires low privileges (PR:L), allowing a network-accessible adversary with such access to obtain and alter a legitimate invitation token with low complexity and no user interaction. Successful exploitation grants high-impact unauthorized access, compromising confidentiality and integrity by enabling the attacker to join restricted organizations.

Red Hat advisories provide mitigation through patches in errata RHSA-2026:2363, RHSA-2026:2364, RHSA-2026:2365, and RHSA-2026:2366, with further details available at https://access.redhat.com/security/cve/CVE-2026-1529. Security practitioners should apply these updates to affected Keycloak deployments.

Details

CWE(s)

CVEs Like This One

CVE-2026-40372Shared CWE-347
CVE-2026-29000Shared CWE-347
CVE-2026-3564Shared CWE-347
CVE-2025-27773Shared CWE-347
CVE-2026-5466Shared CWE-347
CVE-2026-38651Shared CWE-347
CVE-2026-34377Shared CWE-347
CVE-2026-20997Shared CWE-347
CVE-2026-24032Shared CWE-347
CVE-2026-0750Shared CWE-347

References