~ / search / GHSA-w4p5-rfh6-cwrv

GHSA-w4p5-rfh6-cwrv

Keycloak: Unauthorized account takeover via WebAuthn token replay

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-37982

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.6.2 26.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.

References

External links from the advisory. They lead to third-party sites.