3.1
Faible
CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component
Description
A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| keycloak 26.4 | premières → < 26.4.4 | 26.4.4 |
| Red Hat build of Keycloak 26.2 26.2 | premières → < 26.2-12 | 26.2-12 |
| Red Hat build of Keycloak 26.2.11 | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-3 | 26.4-3 |
| Red Hat build of Keycloak 26.4.4 | Versions non publiées |
Références
- RHSA-2025:21370 access.redhat.com
- RHSA-2025:21371 access.redhat.com
- RHSA-2025:22088 access.redhat.com
- RHSA-2025:22089 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2406192 bugzilla.redhat.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de keycloak
Les 15 CVE de keycloak →
CVE-2026-90997
A flaw was found in Keycloak
7.4
Élevée
CVE-2026-1609
A flaw was found in Keycloak
8.1
Élevée
CVE-2025-13467
A flaw was found in the Keycloak LDAP User Federation provider
5.5
Moyenne
CVE-2025-11538
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug ) insecurely defaults to…
6.8
Moyenne