Description
A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.
Published: 2026-05-19
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated user can alter client‑side JavaScript to bypass WebAuthn policies during credential registration. The Keycloak server fails to verify that the new credential’s parameters, such as public key algorithms, conform to the realm’s configured WebAuthn policies. This vulnerability allows the creation of credentials that do not meet administrative security requirements, thereby weakening the system’s authentication posture.

Affected Systems

Red Hat Build of Keycloak. No specific version information is provided.

Risk and Exploitability

The CVSS score of 4.3 indicates a low to moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can manipulate the browser’s JavaScript before submitting the credential registration request; thus the attack vector is an authenticated client‑side manipulation. While the attack surface is limited to users who already have valid accounts, the resulting non‑compliant credentials can be abused for weaker authentication methods and potentially compromise overall security.

Generated by OpenCVE AI on May 19, 2026 at 08:23 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply any available Red Hat patch for Keycloak when released; in the interim, enforce server‑side validation of WebAuthn credential parameters as outlined in the fix, addressing the CWE‑603 flaw.
  • Restrict the credential registration endpoint to privileged users or add additional authorization checks to prevent unauthorized credential creation.
  • Monitor authentication logs for anomalous or non‑compliant credential registrations and take remedial action if detected.

Generated by OpenCVE AI on May 19, 2026 at 08:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-g8vr-x4qh-25qg Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
History

Tue, 02 Jun 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*

Tue, 19 May 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 19 May 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 19 May 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat build Of Keycloak
Vendors & Products Redhat build Of Keycloak

Tue, 19 May 2026 06:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.
Title Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation
First Time appeared Redhat
Redhat build Keycloak
Weaknesses CWE-603
CPEs cpe:/a:redhat:build_keycloak:
Vendors & Products Redhat
Redhat build Keycloak
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Redhat Build Keycloak Build Of Keycloak
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-05-19T16:32:09.823Z

Reserved: 2026-05-18T13:26:21.427Z

Link: CVE-2026-8830

cve-icon Vulnrichment

Updated: 2026-05-19T16:32:04.310Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-19T07:16:30.500

Modified: 2026-06-02T18:54:34.793

Link: CVE-2026-8830

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-05-19T05:00:04Z

Links: CVE-2026-8830 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-19T10:30:02Z

Weaknesses