Описание
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Ссылки
EPSS
8.1 High
CVSS3
Дефекты
Связанные уязвимости
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
A flaw was found in Keycloak. An attacker can exploit this vulnerabili ...
Keycloak affected by improper invitation token validation
Уязвимость компонента JSON Web Token Handler программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
ALT-PU-2026-4227: package `keycloak` update to version 26.5.5-alt1
EPSS
8.1 High
CVSS3