Keycloak

Check if affected (4)

• ▸▾securityhighCVE-2026-1609, token issuance for disabled users

  Applies if you use the JWT Authorization Grant with disabled users.

  Keycloak 26.5.3 fixes an issue in which disabled users could still obtain tokens through the JWT Authorization Grant.

• ▸▾securityhighCVE-2026-1529, cross-organization self-registration through forged invitation JWTs

  Applies if you use invitation JWTs for cross-organization self-registration.

  Keycloak 26.5.3 fixes an issue where a forged invitation JWT could enable cross-organization self-registration.

• ▸▾securityhighCVE-2026-1486, authentication through disabled identity providers

  Applies if you use the JWT Authorization Grant with identity providers that can be disabled.

  Keycloak 26.5.3 fixes a logic bypass in the JWT Authorization Grant that allowed authentication through disabled identity providers.

• ▸▾securitymediumCVE-2025-14778, /uma-policy/ ownership checks

  Applies if you use the /uma-policy/ endpoint.

  Keycloak 26.5.3 fixes incorrect ownership checks in the /uma-policy/ endpoint.