An authenticated user can alter client‑side JavaScript to bypass WebAuthn policies during credential registration. The Keycloak server fails to verify that the new credential’s parameters, such as public key algorithms, conform to the realm’s configured WebAuthn policies. This vulnerability allows the creation of credentials that do not meet administrative security requirements, thereby weakening the system’s authentication posture.

Red Hat Build of Keycloak. No specific version information is provided.

The CVSS score of 4.3 indicates a low to moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can manipulate the browser’s JavaScript before submitting the credential registration request; thus the attack vector is an authenticated client‑side manipulation. While the attack surface is limited to users who already have valid accounts, the resulting non‑compliant credentials can be abused for weaker authentication methods and potentially compromise overall security.