A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Keycloak versions installed prior to 26.5.3 are affected by multiple vulnerabilities as referenced in the advisory.

  - A flaw in Keycloak where the JSON Web Token (JWT) authorization grant preview feature fails to validate a user's   disabled status during JWT authorization grant processing. When this feature is enabled, disabled user accounts   can still be used to obtain valid JWTs. (CVE-2026-1609)

  - An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate   invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the   attacker to successfully self-register into an unauthorized organization, leading to unauthorized   access. (CVE-2026-1529)

  - A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity   Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer)   retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP   (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid   JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens. (CVE-2026-1486)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID
    and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of
    cryptographic signature verification allows the attacker to successfully self-register into an
    unauthorized organization, leading to unauthorized access. (CVE-2026-1529)

ID	Name	Product	Family	Type	Severity
298654	Keycloak < 26.5.3 Multiple Vulnerabilities	Nessus	Misc.	Local	high
437677	SCA: security update for org.keycloak:keycloak-services (GHSA-hcvw-475w-8g7p)	Tenable Cloud Security	SCA Checks	Local	high
437677	SCA: security update for org.keycloak:keycloak-services (GHSA-hcvw-475w-8g7p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-1529

high

Tenable Plugins

high

high

high