CVE-2026-1529
HIGHKeycloak 26.5.0-26.5.2 - Unauthenticated Organization Access via JWT Invitation Token Tampering
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-1529. PoCs published by ninjazan420, 0x240x23elu, ackemed.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-1529, which allows unauthorized organization registration in Keycloak due to improper JWT token validation. The exploit manipulates the `org_id` and `email` fields in the JWT payload to register users in unauthorized organizations.
Description
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Exploits (3)
This repository contains a functional exploit for CVE-2026-1529, which allows unauthorized organization registration in Keycloak due to improper JWT token validation. The exploit manipulates the `org_id` and `email` fields in the JWT payload to register users in unauthorized organizations.
This repository contains a functional exploit for CVE-2026-1529 targeting Keycloak, demonstrating unauthorized access via JWT manipulation and HTTP request crafting. The exploit includes detailed setup guides, configuration options, and troubleshooting steps.
This repository contains a functional exploit for CVE-2026-1529, which allows unauthorized organization registration in Keycloak due to improper JWT token validation. The exploit manipulates the `org_id` and `email` fields in the JWT payload to register users in unauthorized organizations.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N