A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

Affected: Maven: org.keycloak:keycloak-services

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.

keycloak: Incorrect ownership checks in /uma-policy/ org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation

Ein Angreifer kann mehrere Schwachstellen in Red Hat Build of Keycloak ausnutzen, um die Authentifizierung zu umgehen, erweiterte Berechtigungen zu erlangen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen oder Daten zu manipulieren.