CVE-2026-16072: Keycloak Auth Bypass Vulnerability

CVE-2026-16072 Overview

CVE-2026-16072 is an access control flaw [CWE-284] in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address. The administrator can then retrieve the secret registration link directly through the application programming interface (API). Using this link, the administrator can create new user accounts and add them to the organization without holding user management permissions or access to the invited email account. The flaw allows an authorized administrator to bypass security boundaries and add unauthorized members to an organization.

Critical Impact
A delegated administrator can bypass user management controls to provision arbitrary accounts and place them inside an organization boundary, subverting tenant isolation.

Affected Products

Keycloak organization management component
Red Hat build of Keycloak (see vendor advisory for affected versions)
Downstream Red Hat single sign-on offerings referencing this CVE

Discovery Timeline

2026-07-17 - CVE-2026-16072 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16072

Vulnerability Analysis

The flaw resides in how Keycloak's organization management feature handles invitations. Organizations in Keycloak group users into logical tenants managed by delegated administrators. Administrators can invite users by email, which triggers Keycloak to generate a secret registration link. Under normal flow, the link is delivered to the invitee's inbox and completes registration through email verification.

The vulnerability breaks that assumption. An administrator with the manage-organizations permission can issue an invitation for an email address that does not exist. Rather than only sending the link, the API returns the secret registration token directly to the administrator. The administrator can consume the link themselves, creating a new user account bound to the target email and immediately enrolling the account into the organization.

This is a broken access control condition [CWE-284]. The registration endpoint trusts possession of the secret link as proof of email ownership, while the invitation endpoint fails to withhold that secret from callers who lack user creation rights.

Root Cause

The organization invitation API exposes the registration token in its response to callers with organization-management scope. There is no separation between the permission required to invite an email and the permission required to create the underlying user. Consuming the token does not require any correlation with the invited mailbox.

Attack Vector

Exploitation requires an authenticated administrator account that already holds the organization-management permission. The attacker calls the invitation API for an arbitrary email, captures the registration link from the response, and completes account creation. The newly created user becomes a member of the target organization, extending the attacker's control beyond their assigned privileges.

No verified public exploit code is available. Technical detail is documented in the Red Hat CVE-2026-16072 Advisory and Red Hat Bugzilla Entry #2501721.

Detection Methods for CVE-2026-16072

Indicators of Compromise

Keycloak admin event logs showing CREATE_ORGANIZATION_INVITATION followed rapidly by REGISTER and ADD_ORGANIZATION_MEMBER events initiated from the same session or IP address.
User accounts created against email domains that the organization does not control or that no mail server accepts.
Registration link retrieval calls to /admin/realms/{realm}/organizations/{id}/members/invite-user returning tokens consumed by the same administrator client.

Detection Strategies

Correlate Keycloak admin API calls with subsequent account registrations to flag cases where the invitation issuer and the account creator share identifiers.
Baseline expected invitation-to-registration time gaps. Sub-minute intervals from the same source indicate self-consumed invitations.
Alert on organization membership growth that is not preceded by external email verification events from the mail transport layer.

Monitoring Recommendations

Ingest Keycloak admin and user event streams into a centralized SIEM and retain them for forensic review.
Audit accounts holding the manage-organizations role and confirm they do not also require manage-users to function.
Review newly created users tied to organizations for missing email verification metadata or synthetic email domains.

How to Mitigate CVE-2026-16072

Immediate Actions Required

Apply the fixed Keycloak build referenced in the Red Hat CVE-2026-16072 Advisory as soon as it is available for your distribution.
Inventory all identities with the manage-organizations role and reduce assignment to trusted operators only.
Audit organization membership since the affected feature was enabled and remove accounts that lack legitimate email verification.

Patch Information

Red Hat tracks the fix under Bugzilla entry 2501721. Consult the Red Hat CVE-2026-16072 Advisory for the specific Keycloak and Red Hat build of Keycloak versions that resolve the flaw.

Workarounds

Restrict the manage-organizations role to a minimal set of administrators until the patch is applied.
Disable delegated organization invitation flows where feasible and route new members through a centrally managed provisioning pipeline.
Require secondary approval, such as a workflow ticket, before granting or acting on organization-management permissions.

bash

# Configuration example: list role assignments and remove manage-organizations from a user
kcadm.sh get users -r myrealm -q username=deleg-admin
kcadm.sh remove-roles -r myrealm --uusername deleg-admin --rolename manage-organizations