A flaw in Keycloak allows a remote attacker to replay ExecuteActionsActionToken tokens used in the WebAuthn flow. By capturing an execute‑actions email link, the attacker can register their own authenticator to the victim’s account. The successfully added hardware‑backed credential gives the attacker persistent control of the account, effectively achieving account takeover. The weakness involves improper validation preventing token reuse, which is reflected in CWE‑294.

The vulnerability affects Red Hat Builds of Keycloak. No specific product versions are listed in the CNA data, so all releases that include the vulnerable WebAuthn component may be impacted.

The CVSS score of 6.8 indicates moderate to high severity. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring interception or receipt of an execute‑actions email link. Once the token is replayed, an attacker can add a new authenticator to the victim’s account, resulting in an effective persistent takeover without further credentials.