The vulnerability allows an attacker to modify the organization identifier and the target email inside a legitimately issued invitation token. Because the Keycloak service does not verify the cryptographic signature, the altered token is accepted, enabling the attacker to self-register into an unauthorized organization. This results in user creation with potential access to organization resources, constituting a privilege escalation.

Red Hat build of Keycloak, specifically the 26.2 EL9 build (including 26.2.13) and the 26.4 EL9 build (including 26.4.9). These versions were distributed under the Red Hat Product Security advisories RHSA-2026:2363 to RHSA-2026:2366. The flaw was identified in the org.keycloak.services.resources.organizations module.

The CVSS score of 8.1 indicates high severity, but the EPSS score is below 1%, suggesting the probability of exploitation is currently low. The flaw is exploitable remotely by anyone who can obtain a valid invitation token, modify the JWT payload to specify a different organization ID and target email, and submit it to the invitation endpoint. As the token is not signed, no cryptographic check prevents this manipulation. Because the attacker does not need elevated privileges on the Keycloak server, the attack can be performed from outside the network, making it a significant risk for organizations that rely on invitation-based user onboarding.