Keycloak Invitation Token Vulnerability Allows Unauthorized Organization Registration

A vulnerability in Keycloak's invitation token validation process allows unauthorized organization registration. The issue arises because invitation tokens are processed without verifying their cryptographic signatures. An attacker can modify the organization ID and target email in a legitimate invitation token's JSON Web Token (JWT) payload, enabling them to self-register in an unauthorized organization.

Impact

Exploitation of this vulnerability allows unauthorized users to register in organizations they do not belong to, potentially leading to unauthorized access and privileges within those organizations.

Reproduction

To reproduce this vulnerability, obtain a legitimate invitation token and remove the cryptographic signature verification. Then, modify the organization ID and target email in the token's JWT payload before using it to register an account.

Remediation

Users can upgrade to the latest Red Hat build of Keycloak, version 26.4.9, which addresses this vulnerability.