CVE-2026-16072 Red Hat CVE debrief

Who should care

Keycloak administrators and users with delegated administration roles should assess exposure and verify configurations to prevent unauthorized user account creation. This includes reviewing and restricting delegated administrator roles and permissions, monitoring logs for unauthorized account creation attempts, and verifying configurations to prevent exploitation of the invitation link vulnerability. Affected Keycloak users and administrators should review

Why it matters

CVE-2026-16072 allows delegated Keycloak administrators to create unauthorized user accounts, bypassing security boundaries and potentially leading to privilege escalation.

• Delegated administrators can bypass security boundaries and add unauthorized members to an organization
• Unauthorized user accounts can be created without required user management permissions
• The vulnerability allows for potential privilege escalation in Keycloak environments

Technical summary

The vulnerability in Keycloak's organization management component allows a delegated administrator to create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. This link can be used to create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account.

Defensive priority

Assess exposure where Keycloak is used with delegated administration; verify and restrict administrator roles; monitor for unauthorized account creation.

Recommended defensive actions

• Review and restrict delegated administrator roles and permissions in Keycloak
• Monitor Keycloak logs for unauthorized user account creation attempts
• Verify Keycloak configurations to prevent exploitation of the invitation link vulnerability
• Assess exposure where Keycloak is used with delegated administration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE and NVD records detail the vulnerability in Keycloak's organization management component, allowing unauthorized user account creation by delegated administrators. Evidence is limited to public CVE and NVD records. Defenders should verify Keycloak configurations, assess exposure, and monitor for unauthorized account creation attempts. The vulnerability allows for potential privilege escalation in Keycloak environments. Delegated administrators can bypass security boundaries and add unauthorized members to an organization. The N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.