The vulnerability CVE-2026-1529 in Red Hat build of Keycloak 26.2 involves improper verification of cryptographic signatures on invitation tokens. Specifically, an attacker can alter the organization ID and target email within the JSON Web Token (JWT) payload of a legitimate invitation token. Due to the lack of proper signature verification, the attacker can self-register into organizations without authorization. This issue is tracked under CWE-347 (Improper Verification of Cryptographic Signature). Red Hat has released version 26.2.13 to address this security flaw.

Successful exploitation of this vulnerability allows an attacker with limited privileges to gain unauthorized access by registering themselves into organizations they should not be able to join. This results in a high impact on confidentiality and integrity, as unauthorized users can access organizational resources. Availability is not affected. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality and integrity impact.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.2.13 that fixes this vulnerability. Users should upgrade to version 26.2.13 or later to remediate the issue. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. No other mitigations are specified in the vendor advisories.