3.1
Low
CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component
Description
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| keycloak 26.4 | earliest → < 26.4.4 | 26.4.4 |
| Red Hat build of Keycloak 26.2 26.2 | earliest → < 26.2-12 | 26.2-12 |
| Red Hat build of Keycloak 26.2.11 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-3 | 26.4-3 |
| Red Hat build of Keycloak 26.4.4 | Versions not published |
References
- RHSA-2025:21370 access.redhat.com
- RHSA-2025:21371 access.redhat.com
- RHSA-2025:22088 access.redhat.com
- RHSA-2025:22089 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2406192 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of keycloak
The 15 CVEs of keycloak →
CVE-2026-90997
A flaw was found in Keycloak
7.4
High
CVE-2026-1609
A flaw was found in Keycloak
8.1
High
CVE-2025-13467
A flaw was found in the Keycloak LDAP User Federation provider
5.5
Medium
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Medium