Red Hat Keycloak EUVD-2026-30841

Exploitation requires a valid authenticated session with at least low-level privileges in the target Keycloak realm (CVSS PR:L confirmed). The target realm must have WebAuthn credential registration enabled and must have explicit WebAuthn policies configured (e.g., algorithm restrictions); without such policies, there is nothing to bypass. The attacker must be actively performing the WebAuthn credential registration flow and must be capable of intercepting and modifying client-side JavaScript execution or the registration request payload. No special network position is required - exploitation is fully remote over standard HTTPS. Exploitation is limited to integrity impact: the attacker cannot elevate privileges, read protected data, or deny availability as a direct result of this vulnerability. Environments without configured WebAuthn algorithm policies are not meaningfully impacted.

The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) vector with no user interaction required, scoped to unchanged resources, with integrity-only impact (I:L) and no confidentiality or availability impact. This accurately characterizes the threat: a legitimate but low-privileged authenticated user can register a non-compliant credential, undermining the administrative security policy without triggering an immediate breach of data confidentiality. EPSS data was not provided in available intelligence sources, so exploitation probability cannot be quantified probabilistically. No CISA KEV listing and no publicly available proof-of-concept exploit code have been identified. The real-world risk centers on policy compliance degradation rather than direct system compromise - organizations relying on WebAuthn algorithm restrictions for compliance mandates (e.g., FIPS, internal security baselines) face a meaningful policy erosion risk, even though this does not constitute privilege escalation or data exfiltration by itself.

An authenticated user with a valid Keycloak session navigates to the WebAuthn credential registration flow and uses browser developer tools or a JavaScript proxy to intercept and modify the credential creation parameters before submission, substituting a policy-disallowed public key algorithm. Because processAction() does not validate these parameters against the realm's configured WebAuthn policy, the server accepts and stores the non-compliant credential. No public proof-of-concept exploit code has been identified, but the manipulation technique (client-side JavaScript interception) requires only basic web development knowledge and standard browser tooling.