Description
A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.13 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6.3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-26.5 +2 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 26.6.3 | 26.6.3 | GHSA-g8vr-x4qh-25qg |
Advisories 1
- WID-SEC-2026-1573 Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 13, 2026
References
- RHSA-2026:25097 vendor-advisory
- RHSA-2026:25098 vendor-advisory
- RHSA-2026:30049 vendor-advisory
- RHSA-2026:30050 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-8830 vdb-entry
- RHBZ#2479565 issue-tracking