CVE-2026-8830

medium

Published 2026-05-19 · Modified 2026-06-02

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

4.3

Description

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that the newly created credential's parameters, such as public key algorithms, match the realm's configured WebAuthn policies. This could lead to the creation of credentials that do not adhere to administrative security requirements, potentially weakening the overall security posture of the system by allowing non-compliant authentication methods.

Predictions

Exploit likelihood

53%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation Red Hat statement A Moderate security flaw was found in Keycloak's WebAuthn credential registration process. This issue allows an authenticated attacker to bypass configured WebAuthn policies, such as algorithm requirements or user…

Description

keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

Red Hat statement

A Moderate security flaw was found in Keycloak's WebAuthn credential registration process. This issue allows an authenticated attacker to bypass configured WebAuthn policies, such as algorithm requirements or user verification, by manipulating client-side JavaScript during registration. This bypass could lead to the registration of credentials that do not meet the intended security standards, potentially weakening the overall authentication posture.

CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Package state

Product	Package	State
Red Hat Build of Keycloak	`rhbk/keycloak-rhel9-operator`	Affected

Affected

Vendor	Product	Version
redhat	Red Hat Build of Keycloak	`Affected`

Application impact

Vendor	Product	Versions	Fixed
redhat	build_of_keycloak	`-`

References

CWEs

CWE-603

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.