CVE-2026-8830

MEDIUM

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

Title source: cna
STIX 2.1

Description

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:25098
https://access.redhat.com/errata/RHSA-2026:25098
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:25097
https://access.redhat.com/errata/RHSA-2026:25097
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30049
https://access.redhat.com/errata/RHSA-2026:30049
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30050
https://access.redhat.com/errata/RHSA-2026:30050
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-8830
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2479565
https://bugzilla.redhat.com/show_bug.cgi?id=2479565

Scores

CVSS v3 4.3
EPSS 0.0039
EPSS Percentile 31.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-603
Status published
Products (12)
org.keycloak/keycloak-services 0 - 26.6.3Maven
Red Hat/Red Hat Build of Keycloak
Red Hat/Red Hat build of Keycloak 26.4 26.4-19
Red Hat/Red Hat build of Keycloak 26.4 26.4.13-1
Red Hat/Red Hat build of Keycloak 26.4.13
Red Hat/Red Hat build of Keycloak 26.6 26.6-6
Red Hat/Red Hat build of Keycloak 26.6 26.6-8
Red Hat/Red Hat build of Keycloak 26.6 26.6.3-3
Red Hat/Red Hat build of Keycloak 26.6 26.6.4-2
Red Hat/Red Hat build of Keycloak 26.6.3
... and 2 more
Published May 19, 2026
Tracked Since May 19, 2026