Threats Tagged 'cve-2026-1529'

Red Hat has released security updates for the Red Hat build of Keycloak 26.2.13 images used in OpenShift Container Platform. The update addresses two security vulnerabilities: improper invitation token validation allowing unauthorized organization registration (CVE-2026-1529) and incorrect ownership checks in the /uma-policy/ endpoint (CVE-2025-14778). These issues could impact authentication and authorization processes within Keycloak deployments. The update is provided as new container images aligning with the standalone product release for on-premise or private cloud deployments.

Red Hat has released a security advisory for the Red Hat build of Keycloak 26.4.9 images used on OpenShift Container Platform. The update addresses multiple security vulnerabilities including improper invitation token validation, acceptance of disabled identity providers for JWT authorization, incorrect ownership checks, unauthorized modification of user attributes, unauthorized token issuance for disabled users, and exposure of sensitive user attributes via the Admin API. These issues could allow unauthorized access or privilege escalation within Keycloak deployments. The advisory provides updated container images to remediate these vulnerabilities.

Red Hat build of Keycloak 26.4.9 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes: * Unauthorized organization registration via improper invitation token validation (CVE-2026-1529) * Disabled identity providers are still accepted for JWT Authorization Grant (CVE-2026-1486) * Incorrect ownership checks in /uma-policy/ (CVE-2025-14778) * Unauthorized modification of unmanaged user attributes by administrators (CVE-2026-0871) * keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users (CVE-2025-14559) * Limited administrator can retrieve sensitive user attributes via Admin API (CVE-2025-13881)

Red Hat build of Keycloak 26.2.13 addresses two security vulnerabilities: an unauthorized organization registration issue due to improper invitation token validation (CVE-2026-1529) and incorrect ownership checks in the /uma-policy/ endpoint (CVE-2025-14778). These issues could allow unauthorized actions related to organization registration and policy ownership validation. The update is classified as important by Red Hat and applies to the Red Hat build of Keycloak. Users are advised to back up their installations before applying the update.

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.