EUVD-2026-30886
GHSA-w4p5-rfh6-cwrv
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
DescriptionCVE.org
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
AnalysisAI
Token replay exploitation in Red Hat Build of Keycloak's WebAuthn flow allows an unauthenticated remote attacker who intercepts an ExecuteActionsActionToken email link to enroll their own hardware-backed WebAuthn authenticator to a victim's account. Successful exploitation bypasses authentication entirely and grants the attacker persistent, credential-backed access to the compromised account. No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent, but the High confidentiality and integrity impact from CVSS underscores the severity if the attack preconditions are met.
Technical ContextAI
Red Hat Build of Keycloak is an enterprise identity and access management (IAM) platform derived from the upstream Keycloak project. The vulnerability resides in the WebAuthn (Web Authentication API) registration flow, specifically in how Keycloak validates and enforces single-use semantics on ExecuteActionsActionTokens - short-lived signed tokens distributed via email to trigger user-side actions such as required action completion or credential setup. The root cause is improper token replay protection: the token either is not invalidated after its first use, is not bound to a specific session or context, or the WebAuthn registration path does not enforce the token's intended scope. Although no CWE is formally assigned in the submission, this maps conceptually to replay attack weaknesses (analogous to CWE-294: Authentication Bypass by Capture-replay). The affected CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:* covers all tracked versions of Red Hat's Keycloak build with no version ceiling confirmed in the available data.
RemediationAI
No specific patched version number was provided in the available intelligence data; the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-37982 should be consulted for the authoritative fix version once published. Until a patch is applied, compensating controls should focus on limiting the attack surface of the vulnerable token flow: disable WebAuthn registration via email-triggered execute-actions workflows if WebAuthn enrollment can be enforced through a separate, administrator-controlled channel (trade-off: reduces self-service enrollment capability). Reduce token TTL for ExecuteActionsActionTokens to the shortest operationally feasible window to shrink the interception and replay window. Enforce email delivery over TLS and audit mail relay configurations to reduce interception risk. Monitor Keycloak audit logs for unexpected WebAuthn credential registrations, particularly those occurring on accounts where the user did not initiate registration. The Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2455329 may contain interim guidance or patch commits as the fix progresses.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today