CVE-2026-1529
Published: 09 February 2026
Summary
CVE-2026-1529 is a high-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability in Redhat (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1529, published on 2026-02-09, is a vulnerability in Keycloak stemming from a lack of cryptographic signature verification on JSON Web Token (JWT) payloads in legitimate invitation tokens. An attacker can modify the organization ID and target email within such a token, enabling successful self-registration into an unauthorized organization and resulting in unauthorized access. The flaw is rated at CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and maps to CWE-347 (Improper Verification of Cryptographic Signature).
The attack requires low privileges (PR:L), allowing a network-accessible adversary with such access to obtain and alter a legitimate invitation token with low complexity and no user interaction. Successful exploitation grants high-impact unauthorized access, compromising confidentiality and integrity by enabling the attacker to join restricted organizations.
Red Hat advisories provide mitigation through patches in errata RHSA-2026:2363, RHSA-2026:2364, RHSA-2026:2365, and RHSA-2026:2366, with further details available at https://access.redhat.com/security/cve/CVE-2026-1529. Security practitioners should apply these updates to affected Keycloak deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6891
Vulnerability details
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to…
more
successfully self-register into an unauthorized organization, leading to unauthorized access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
JWT signature bypass enables privilege escalation to unauthorized orgs (T1068) via exploitation of public-facing Keycloak (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates implementation of cryptographic mechanisms, including digital signatures, to prevent unauthorized modification of JWT payloads in invitation tokens.
Requires use of digital signatures and integrity verification to detect unauthorized alterations to information such as JWT invitation token payloads.
Ensures timely remediation of specific flaws like improper cryptographic signature verification on JWTs through patching and flaw correction.